Anti-dfa white-box protection method based on redundant computation and and operation

Abstract

The application provides an anti-DFA white-box protection method based on redundancy calculation and AND operation, wherein according to the adopted cryptographic algorithm and the highest attack round number of differential fault analysis on the cryptographic algorithm, the protection round in the white-box protection is determined; the adopted cryptographic algorithm is normally encrypted from plaintext to the protection round; from the protection round, the adopted cryptographic algorithm is divided into two independent branches, and independent operations are respectively performed to ciphertext to obtain two independent ciphertexts; the obtained two ciphertexts are subjected to bitwise AND operation to output the final ciphertext; and on the basis of considering the necessary conditions required by differential fault analysis, the security requirement of resisting differential fault analysis is achieved by hiding the real differential value.

Description

Technical Field

[0001] This invention relates to the field of anti-DFA white-box protection technology, and in particular to an anti-DFA white-box protection method based on redundancy calculation and AND operation. Background Technology

[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.

[0003] Traditional cryptographic algorithms offer no security whatsoever under a white-box security model. Therefore, a novel cryptographic technique is needed to guarantee the required security under a white-box model, achieving a higher level of information security. In 2002, Chow et al. first proposed a lookup table-based white-box scheme, embedding a key lookup table into the cryptographic algorithm and protecting it using obfuscation techniques, thus initiating research into white-box cryptographic algorithms. Subsequently, Biryukov et al. proposed a Boolean mask-based white-box scheme at the 2018 Sub-Security Conference, thus launching the mask-based design trend.

[0004] The openness of devices and the white-box security model make fault injection easier to execute and less costly. Therefore, differential fault analysis has become an effective white-box analysis method. Differential fault analysis is an analysis method that combines fault injection analysis method with traditional differential cryptography method. It mainly uses the relationship between the correct output of the same plaintext under normal conditions and the incorrect output after fault injection to crack the key.

[0005] The inventors discovered that applying differential fault analysis to the white-box protection schemes proposed by Chow et al. (based on lookup tables, Boolean circuits, and Boolean circuits with linear mask protection) and Biryukov et al. (based on Boolean circuits with nonlinear mask protection) can successfully recover the key, proving the effectiveness of differential fault analysis on these white-box protection schemes. However, to meet higher security standards and be applicable to more work scenarios, there is currently a lack of white-box protection schemes that can resist differential fault analysis, and none of the existing white-box protection schemes can yet resist the recovery of the key by differential fault analysis. Summary of the Invention

[0006] To address the shortcomings of existing technologies, this invention provides a white-box protection method against differential fault analysis (DFA) based on redundant computation and AND operation. Considering the necessary conditions for implementing differential fault analysis, this method achieves the security requirement of resisting differential fault analysis by hiding the true differential value.

[0007] To achieve the above objectives, the present invention adopts the following technical solution: The first aspect of this invention provides a DFA-resistant white-box protection method based on redundant computation and AND operation, and more particularly, a DFA-resistant white-box protection method based on redundant computation and ciphertext AND operation.

[0008] A white-box protection method against DFA based on redundant computation and ciphertext AND operation includes the following steps: Based on the cryptographic algorithm used and the highest number of attack rounds against the cryptographic algorithm using differential fault analysis, the protection rounds in white-box protection are determined. The chosen cryptographic algorithm is used to encrypt the plaintext normally up to the protection wheel; Starting from the protection wheel, the cryptographic algorithm used is divided into two independent branches, and each branch is processed independently to produce ciphertext, resulting in two independent ciphertexts. Perform a bitwise AND operation on the two ciphertexts to output the final ciphertext.

[0009] As a further limitation of the first aspect of the present invention, after determining that the protection rounds are from the Nth to the Mth rounds, the plaintext is encrypted normally up to the Nth round.

[0010] As a further limitation of the first aspect of the present invention, starting from the Nth round, the intermediate state of the (N-1)th round is divided into two independent branches and each branch is independently calculated using a key until the output of the Mth round, i.e., the two independent ciphertexts, is obtained.

[0011] As a further limitation of the first aspect of the present invention, the two ciphertexts are subjected to a bitwise AND operation to output the final ciphertext, including: bit 1 is bitwise ANDed with other bits and the result is still other bits, and bit 0 is bitwise ANDed with other bits and the result is still 0.

[0012] The second aspect of the present invention provides a DFA-resistant white-box protection system based on redundant computation and AND operation, and particularly provides a DFA-resistant white-box protection system based on redundant computation and ciphertext AND operation.

[0013] A DFA-resistant white-box protection system based on redundant computation and ciphertext operations, comprising: The protection wheel determination module is configured to: determine the protection wheel in white-box protection based on the cryptographic algorithm used and the highest number of attack rounds against the cryptographic algorithm by differential fault analysis; The encryption module is configured to encrypt the plaintext normally up to the protection wheel using the chosen cryptographic algorithm. The ciphertext decomposition module is configured to: starting from the protection wheel, divide the adopted cryptographic algorithm into two independent branches, perform independent operations on each branch to obtain two independent ciphertexts; The ciphertext bitwise AND calculation module is configured to perform a bitwise AND operation on the two obtained ciphertexts and output the final ciphertext.

[0014] As a further limitation of the second aspect of the present invention, after determining that the protection rounds are from the Nth round to the Mth round, the plaintext is encrypted normally up to the Nth round.

[0015] As a further limitation of the second aspect of the present invention, starting from the Nth round, the intermediate state of the (N-1)th round is divided into two independent branches and each branch is independently calculated using a key until the output of the Mth round, i.e., the two independent ciphertexts, is obtained.

[0016] As a further limitation of the second aspect of the present invention, the two ciphertexts are subjected to a bitwise AND operation to output the final ciphertext, including: bit 1 is bitwise ANDed with other bits and the result is still other bits, and bit 0 is bitwise ANDed with other bits and the result is still 0.

[0017] The third aspect of the present invention provides a DFA white-box protection method based on redundant computation and AND operation, and particularly provides a DFA white-box protection method based on redundant computation and intermediate state AND operation.

[0018] A white-box protection method against DFA based on redundant computation and intermediate state AND operation includes the following process: Based on the cryptographic algorithm used and the highest number of attack rounds against the cryptographic algorithm using differential fault analysis, the protection rounds in white-box protection are determined. The plaintext is encrypted normally from the beginning to the protection wheel according to the cryptographic algorithm used. In the protection wheel, the cryptographic algorithm is divided into two independent branches, and each branch is processed independently to obtain two independent intermediate states; Perform a bitwise AND operation on the two intermediate states to combine them into one, and then perform all the remaining cryptographic operations until the final ciphertext is obtained.

[0019] As a further limitation of the third aspect of the present invention, after determining that the protection rounds are from round X to round Y, the plaintext is encrypted normally up to round X.

[0020] As a further limitation of the third aspect of the present invention, starting from the Xth round, the intermediate state of the (X-1)th round is divided into two independent branches and each branch is independently calculated using a key until the output of the Yth round, i.e., the two independent ciphertexts, is obtained.

[0021] The fourth aspect of the present invention provides a DFA-resistant white-box protection system based on redundant computation and AND operation, and particularly provides a DFA-resistant white-box protection system based on redundant computation and intermediate state AND operation.

[0022] A DFA-resistant white-box protection system based on redundant computation and intermediate state AND operation, comprising: The protection wheel determination module is configured to: determine the protection wheel in white-box protection based on the cryptographic algorithm used and the highest number of attack rounds against the cryptographic algorithm by differential fault analysis; The encryption module is configured to encrypt the plaintext normally up to the protection wheel according to the cryptographic algorithm used. The intermediate state decomposition module is configured to: divide the cryptographic algorithm into two independent branches in the protection wheel, and perform independent operations on each branch to obtain two independent intermediate states; The intermediate state bit and calculation module is configured to perform a bitwise AND operation on the two intermediate states to combine them into one, and then perform all remaining cryptographic operations until the final ciphertext is obtained.

[0023] As a further limitation of the fourth aspect of the present invention, after determining that the protection rounds are from round X to round Y, the plaintext is encrypted normally up to round X.

[0024] As a further limitation of the fourth aspect of the present invention, starting from the Xth round, the intermediate state of the (X-1)th round is divided into two independent branches and each branch is independently calculated using a key until the output of the Yth round is obtained, which is the two independent ciphertexts.

[0025] The fifth aspect of the present invention provides a computer-readable storage medium having a program stored thereon, which, when executed by a processor, implements the steps of the anti-DFA white-box protection method based on redundant computation and ciphertext AND operation as described in the first aspect of the present invention, or the steps of the anti-DFA white-box protection method based on redundant computation and intermediate state AND operation as described in the third aspect of the present invention.

[0026] The sixth aspect of the present invention provides an electronic device, including a memory, a processor, and a program stored in the memory and executable on the processor. When the processor executes the program, it implements the steps in the anti-DFA white-box protection method based on redundant computation and ciphertext operation as described in the first aspect of the present invention, or the steps in the anti-DFA white-box protection method based on redundant computation and intermediate state AND operation as described in the third aspect of the present invention.

[0027] Compared with the prior art, the beneficial effects of the present invention are: 1. This invention hides the true differential. Differential fault analysis requires combining the correct ciphertext and the faulty ciphertext for differential analysis after a successful fault injection to recover the key. This invention performs a bitwise AND operation on the two independent ciphertexts. Based on the properties of the bitwise AND operation, it ensures that the encryption program can obtain the correct ciphertext normally when it is not fault-injected, and also ensures that the encryption program cannot obtain the correct faulty ciphertext when it is fault-injected. The resulting erroneous faulty ciphertext is the result of a bitwise AND operation between the correct ciphertext and the correct faulty ciphertext, thus ensuring the hiding of the true differential. Analysts obtain an incorrect set of candidate keys through the incorrect differential and cannot recover the correct key.

[0028] 2. This invention innovatively proposes a DFA-resistant white-box protection method based on redundant computation and AND operation, which is applicable to various block cipher algorithms and can be implemented on white-box protection schemes other than those based on lookup tables, providing a general framework for white-box protection schemes.

[0029] 3. This invention increases the difficulty of successfully injecting faults. Existing white-box fault injection technology injects random faults into the encrypted program and determines the location of the fault injection by using the encrypted ciphertext. This invention divides the protection wheel into two independent branches for independent calculation. To obtain equivalent fault injection, the same fault needs to be injected into the same position in each of the two independent branches. This is very difficult for existing white-box fault injection technology and is almost impossible to achieve.

[0030] 4. This invention increases the complexity of differential fault analysis. In order to perform differential fault analysis and obtain the correct key, the analyst needs to obtain the true ciphertext differential, which is equivalent to obtaining the true fault ciphertext. Due to the nature of bitwise AND operation: bit 1 ANDed with other bits still results in other bits, and bit 0 ANDed with other bits still results in 0. In order to obtain the true fault ciphertext, the analyst needs to exhaustively enumerate all possible values ​​of bit 0 in the correct ciphertext and perform differential analysis on the ciphertext obtained under each exhaustive enumeration, which significantly increases the complexity of differential fault analysis.

[0031] 5. This invention hides the true difference. Differential fault analysis requires key recovery by combining the correct ciphertext and the faulty ciphertext after a successful fault injection. This invention performs a bitwise AND operation on two independent intermediate states. Based on the properties of bitwise AND operations, this step ensures that the encryption program can obtain the correct ciphertext when it is not affected by fault injection, and also ensures that the encryption program cannot obtain the correct intermediate state when it is affected by fault injection, thus resulting in an incorrect faulty ciphertext, thereby ensuring the hiding of the true difference.

[0032] 6. This invention has the effect of resisting differential fault analysis. In order to perform differential fault analysis to obtain the correct key, the attacker needs to obtain the real ciphertext differential, which is equivalent to obtaining the real faulty ciphertext. Since the attacker cannot directly observe the intermediate state, he needs to guess the faulty ciphertext in the whole space, which not only has high complexity but also obtains the whole key space, making it impossible to recover the correct key.

[0033] Advantages of additional aspects of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0034] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0035] Figure 1 This is an overall framework diagram of the white-box protection method based on redundancy calculation and ciphertext AND operation for differential fault analysis provided in Embodiment 1 of the present invention. Figure 2 This is a flowchart of the AES cryptographic algorithm provided in Embodiment 1 of the present invention; Figure 3 This is an overall block diagram of the white-box protection scheme for the AES cryptographic algorithm provided in Embodiment 1 of the present invention; Figure 4 This is a schematic diagram of the basic process of differential fault analysis provided in Embodiment 1 of the present invention; Figure 5 This is a schematic diagram of the most effective differential fault analysis method for the AES cryptographic algorithm provided in Embodiment 1 of the present invention; Figure 6 This is a schematic diagram illustrating the correct encryption process of the AES cryptographic algorithm provided in Embodiment 1 of the present invention; Figure 7 This is a schematic diagram of the process of performing fault injection on the AES cryptographic algorithm and then performing fault encryption, as provided in Embodiment 1 of the present invention. Figure 8 This is an overall block diagram of the white-box protection scheme for the AES cryptographic algorithm provided in Embodiment 3 of the present invention. Detailed Implementation

[0036] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0037] It should be noted that the following detailed descriptions are exemplary and intended to provide further illustration of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0038] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of exemplary embodiments according to the invention. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0039] Where there is no conflict, the embodiments and features in the embodiments of the present invention can be combined with each other.

[0040] Example 1: This invention, considering the necessary conditions for implementing differential fault analysis, proposes a white-box protection method against differential fault analysis based on redundant computation and ciphertext AND operation. This method achieves its security requirement against differential fault analysis by hiding the actual differential value. Specifically, it is constructed based on the Advanced Encryption Standard (AES) cryptographic algorithm and includes the following processes: S1: Determine the protective wheel.

[0041] Currently, differential fault analysis for the AES cryptographic algorithm typically involves injecting a random fault between the last two column obfuscations. After the fault passes through one column obfuscation, it propagates to four bytes in the ciphertext. The fault location is then determined by the fault ciphertext pattern. Since the last round of the AES cryptographic algorithm does not include column obfuscation, differential fault analysis protection is required for the last three rounds, i.e., the protection rounds are rounds 8 to 10.

[0042] S2: The cryptographic algorithm encrypts the plaintext normally from the beginning to the protection wheel.

[0043] After determining the protection rounds to be from the 8th to the 10th round, the plaintext was then encrypted normally up to the 8th round.

[0044] S3: Starting from the protection wheel, the cryptographic algorithm is divided into two independent branches, and each branch is processed independently to produce ciphertext, resulting in two independent ciphertexts.

[0045] Starting from round 8, the intermediate state of round 7 is divided into two independent branches and each branch is processed independently using the key until the output of round 10, which is the two independent ciphertexts, is obtained.

[0046] S4: Perform a bitwise AND operation on the two ciphertexts obtained and output the final ciphertext.

[0047] After obtaining two independent ciphertexts, perform a bitwise AND operation on these two ciphertexts to output the final ciphertext.

[0048] Figure 1 The overall framework of a white-box protection scheme based on redundancy calculation and ciphertext AND operation for differential fault analysis is presented. Figure 2 The basic flow of the AES cryptographic algorithm is demonstrated; a white-box protection scheme based on redundant computation and ciphertext AND operation to resist differential fault analysis is presented, such as... Figure 3 As shown, the AES cryptographic algorithm is used as an example for construction; Figure 4 This demonstrates the basic process of differential fault analysis; Figure 5 This demonstrates the most effective differential fault analysis method for the AES cryptographic algorithm; Figure 6 This is the process of correctly encrypting data using the AES cryptographic algorithm; Figure 7 It is the process of fault encryption after an adversary successfully performs fault injection on the AES cryptographic algorithm.

[0049] like Figures 5-7 As shown, after successfully injecting a fault, the adversary will... Figure 6 The ciphertext result correctly encrypted by the AES cryptographic algorithm shown is as follows: Figure 7 A difference equation is established based on the ciphertext result of the fault encryption shown. The difference equation is constructed as follows: remember: (1) (2) Then we have: Let , Then we have: (3) (4) Similarly, the other three bytes can also yield similar equations: (5) (6) (7) In this equation, Z, Y0, Y1, Y2, and Y3 are all unknown, but Y0, Y1, Y2, and Y3 are fixed values. By solving for the Z value that satisfies the four equations, we obtain the solution set Y0, Y1, Y2, and Y3 corresponding to each candidate Z value. Substituting these values ​​into the following equation, we can solve for the key: (8) , (9) (10) This invention improves the complexity of differential fault analysis. The differential equation involves a total of 32 bits, but compared with the white-box protection scheme that does not use the technology of this invention, the technology of this invention hides 16 bits of ciphertext XOR value information on average. Therefore, the technology of this invention improves the complexity of differential fault analysis by 65,536 times.

[0050] Example 2: Embodiment 2 of the present invention provides a DFA-resistant white-box protection system based on redundant computation and ciphertext AND operation, comprising: The protection wheel determination module is configured to: determine the protection wheel in white-box protection based on the cryptographic algorithm used and the highest number of attack rounds against the cryptographic algorithm by differential fault analysis; The encryption module is configured to encrypt the plaintext normally up to the protection wheel using the chosen cryptographic algorithm. The ciphertext decomposition module is configured to: starting from the protection wheel, divide the adopted cryptographic algorithm into two independent branches, perform independent operations on each branch to obtain two independent ciphertexts; The ciphertext bitwise AND calculation module is configured to perform a bitwise AND operation on the two obtained ciphertexts and output the final ciphertext.

[0051] The working method of the system is the same as the anti-DFA white-box protection method based on redundant calculation and ciphertext AND operation provided in Example 1, and will not be repeated here.

[0052] Example 3: Embodiment 3 of this invention provides a DFA-resistant white-box protection method based on redundant computation and intermediate state AND operations, constructed based on the Advanced Encryption Standard (AES) cryptographic algorithm, such as... Figure 8 As shown, the process includes the following: M1: Determine the protective wheel.

[0053] Currently, the international practice for differential fault analysis of the AES cryptographic algorithm typically involves injecting a random fault between the last two column obfuscations. After the fault passes through one column obfuscation, it propagates to four bytes in the ciphertext. The fault location is then determined by the faulty ciphertext pattern. Since the last round of the AES cryptographic algorithm does not include column obfuscation, we need to perform differential fault analysis protection on the 8th and 9th rounds, i.e., the protection rounds are the 8th and 9th rounds.

[0054] M2: The cryptographic algorithm encrypts plaintext normally from the beginning to the protection wheel.

[0055] After determining that the protection rounds are the 8th and 9th rounds, the plaintext is encrypted normally up to the 8th round.

[0056] M3: Starting from the protection wheel, the cryptographic algorithm is divided into two independent branches, each of which is processed independently to produce ciphertext, resulting in two independent ciphertexts.

[0057] Starting from round 8, the intermediate state of round 7 is divided into two independent branches and each branch is processed independently using the key until the output of round 9, which is the two independent intermediate states, is obtained.

[0058] M4: Perform a bitwise AND operation on the two intermediate states to merge them into one, and then perform all the remaining cryptographic operations until the ciphertext is output. Specifically, perform a bitwise AND operation on the two intermediate states and continue with all remaining cryptographic operations to output the final ciphertext.

[0059] This embodiment is resistant to differential fault analysis. Because the intermediate state of the 9th round output undergoes an AND operation after successful fault injection, and the attacker cannot directly observe the intermediate state value, the obtained faulty ciphertext does not directly expose any bit of the true ciphertext difference. To obtain the true ciphertext difference, the attacker needs to exhaustively search the entire space of the valid faulty ciphertext, resulting in a complexity of 2^32. 32 Furthermore, it will obtain the keys for the entire space, making it impossible to effectively filter the keys.

[0060] Example 4: Embodiment 4 of the present invention provides a DFA-resistant white-box protection system based on redundant computation and intermediate state AND operation, comprising: The protection wheel determination module is configured to: determine the protection wheel in white-box protection based on the cryptographic algorithm used and the highest number of attack rounds against the cryptographic algorithm by differential fault analysis; The encryption module is configured to encrypt the plaintext normally up to the protection wheel according to the cryptographic algorithm used. The intermediate state decomposition module is configured to: divide the cryptographic algorithm into two independent branches in the protection wheel, and perform independent operations on each branch to obtain two independent intermediate states; The intermediate state bit and calculation module is configured to perform a bitwise AND operation on the two intermediate states to combine them into one, and then perform all remaining cryptographic operations until the final ciphertext is obtained.

[0061] The working method of the system is the same as the anti-DFA white-box protection method based on redundancy calculation and intermediate state operation provided in Embodiment 3, and will not be repeated here.

[0062] Example 5: Embodiment 5 of the present invention provides a computer-readable storage medium storing a program thereon. When the program is executed by a processor, it implements the steps of the anti-DFA white-box protection method based on redundant computation and ciphertext AND operation as described in Embodiment 1 of the present invention, or the anti-DFA white-box protection method based on redundant computation and intermediate state AND operation as described in Embodiment 3 of the present invention.

[0063] Example 6: Embodiment 6 of the present invention provides an electronic device, including a memory, a processor, and a program stored in the memory and executable on the processor. When the processor executes the program, it implements the steps of the anti-DFA white-box protection method based on redundant calculation and ciphertext AND operation as described in Embodiment 1 of the present invention or the anti-DFA white-box protection method based on redundant calculation and intermediate state AND operation as described in Embodiment 3 of the present invention.

[0064] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for DFA white-box protection based on redundant computation and AND operation, characterized in that, Includes the following processes: Based on the cryptographic algorithm used and the highest number of attack rounds against the cryptographic algorithm using differential fault analysis, the protection rounds in white-box protection are determined. The chosen cryptographic algorithm is used to encrypt the plaintext normally up to the protection wheel; Starting from the protection wheel, the cryptographic algorithm used is divided into two independent branches, and each branch is processed independently to produce ciphertext, resulting in two independent ciphertexts. Perform a bitwise AND operation on the two ciphertexts to output the final ciphertext.

2. The anti-DFA white-box protection method based on redundant computation and AND operation as described in claim 1, characterized in that, After determining that the protection rounds are from round N to round M, the plaintext is encrypted normally up to round N.

3. The anti-DFA white-box protection method based on redundant computation and AND operation as described in claim 2, characterized in that, Starting from round N, the intermediate state of round N-1 is divided into two independent branches, and each branch is processed independently using the key until the output of round M, i.e., the two independent ciphertexts, is obtained.

4. A DFA-resistant white-box protection system based on redundant computation and AND operation, characterized in that, include: The protection wheel determination module is configured to: determine the protection wheel in white-box protection based on the cryptographic algorithm used and the highest number of attack rounds against the cryptographic algorithm by differential fault analysis; The encryption module is configured to encrypt the plaintext normally up to the protection wheel using the chosen cryptographic algorithm. The ciphertext decomposition module is configured to: starting from the protection wheel, divide the adopted cryptographic algorithm into two independent branches, perform independent operations on each branch to obtain two independent ciphertexts; The ciphertext bitwise AND calculation module is configured to perform a bitwise AND operation on the two obtained ciphertexts and output the final ciphertext.

5. A method for DFA white-box protection based on redundant computation and AND operation, characterized in that, Includes the following processes: Based on the cryptographic algorithm used and the highest number of attack rounds against the cryptographic algorithm using differential fault analysis, the protection rounds in white-box protection are determined. The plaintext is encrypted normally from the beginning to the protection wheel according to the cryptographic algorithm used. In the protection wheel, the cryptographic algorithm is divided into two independent branches, and each branch is processed independently to obtain two independent intermediate states; Perform a bitwise AND operation on the two intermediate states to combine them into one, and then perform all the remaining cryptographic operations until the final ciphertext is obtained.

6. The anti-DFA white-box protection method based on redundant computation and AND operation as described in claim 5, characterized in that, After determining that the protection rounds are from round X to round Y, the plaintext is encrypted normally up to round X.

7. The anti-DFA white-box protection method based on redundant computation and AND operation as described in claim 6, characterized in that, Starting from round X, the intermediate state of round X-1 is divided into two independent branches, and each branch is processed independently using the key until the output of round Y, i.e., the two independent ciphertexts, is obtained.

8. A DFA-resistant white-box protection system based on redundant computation and AND operation, characterized in that, include: The protection wheel determination module is configured to: determine the protection wheel in white-box protection based on the cryptographic algorithm used and the highest number of attack rounds against the cryptographic algorithm by differential fault analysis; The encryption module is configured to encrypt the plaintext normally up to the protection wheel according to the cryptographic algorithm used. The intermediate state decomposition module is configured to: divide the cryptographic algorithm into two independent branches in the protection wheel, and perform independent operations on each branch to obtain two independent intermediate states; The intermediate state bit and calculation module is configured to perform a bitwise AND operation on the two intermediate states to combine them into one, and then perform all remaining cryptographic operations until the final ciphertext is obtained.

9. A computer-readable storage medium having a program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps in the anti-DFA white-box protection method based on redundant computation and AND operation as described in any one of claims 1-3, or the steps in the anti-DFA white-box protection method based on redundant computation and AND operation as described in any one of claims 5-7.

10. An electronic device comprising a memory, a processor, and a program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps in the anti-DFA white-box protection method based on redundant computation and AND operation as described in any one of claims 1-3, or the steps in the anti-DFA white-box protection method based on redundant computation and AND operation as described in any one of claims 5-7.

Images