Small white-box AES algorithm for vehicle-mounted system

Abstract

The invention provides a small white-box AES algorithm for a vehicle-mounted system, which comprises the steps of generating an in-vehicle trusted root through white-box AES encryption, carrying out encryption and decryption operation through the trusted root, firstly carrying out an AES basic encryption process, setting an intermediate value variable state as a byte array, and then carrying out round key addition, the method comprises the following steps: performing exclusive OR on an intermediate value state and a round key, then performing byte replacement, performing mapping through an S box, then starting line displacement, performing replacement between internal bytes of an intermediate value state matrix, performing column confusion after completion of replacement, performing reversible matrix on intermediate values, influencing one column of the intermediate value state in each action, repeating the operation, and completing ten rounds of encryption. Wherein in the encryption process, the proportion of using a confusion table and algorithm restoration in the encryption process is judged according to CipherState, then encryption is carried out in a confusion table query mode, and part of the confusion table is restored into an algorithm to participate in the encryption and decryption process; the AES algorithm secret key is protected through a white box, and corresponding rom is carried out for the specific version of the vehicle machine.

Description

Technical Field

[0001] The invention belongs to the field of AES algorithms, and in particular relates to a small white box AES algorithm for a vehicle-mounted system. Background Art

[0002] With the rapid development of smart cars and in-vehicle systems, information security and data protection have become the focus of industry attention. In-vehicle systems usually involve the processing of a large amount of sensitive information, including vehicle positioning information, user personal data, and various types of data transmitted in the Internet of Vehicles. Therefore, it is crucial to ensure the confidentiality, integrity, and availability of this information. Among the many encryption algorithms, AES (Advanced Encryption Standard) is widely used in various secure communication occasions due to its high efficiency and security. However, existing in-vehicle systems still have some significant defects when implementing the AES algorithm.

[0003] Existing AES implementations are often limited by hardware resources. In-vehicle systems generally require small size and low power consumption, while traditional AES algorithm implementations usually require large storage and computing resources. This makes the implementation of the AES algorithm difficult in resource-constrained environments, resulting in increased system latency during encryption and decryption, which affects the real-time performance and response speed of the in-vehicle system. In addition, the computing platform of the in-vehicle system is often based on embedded devices, which have relatively weak processing capabilities and cannot efficiently execute complex AES algorithms, thus affecting the security performance of the overall system.

[0004] The existing AES algorithm has insufficient protection against side-channel attacks. Side-channel attacks are attacks where an attacker obtains key information by observing the physical signals (such as power consumption, time delay, etc.) generated by the encryption device when performing encryption operations. This type of attack is particularly dangerous in vehicle systems because hackers can attack and obtain sensitive data by analyzing the vehicle's signals and behavior. Therefore, traditional AES implementations need to strengthen protection against side-channel attacks, but current implementations often fail to take this into account, resulting in insufficient security.

[0005] Existing AES implementations usually lack flexibility and adaptability. In different application scenarios, the requirements for encryption algorithms may be different. For example, in the Internet of Vehicles environment, data transmission is frequent and diverse, requiring encryption algorithms to be able to flexibly adapt to different data streams and encryption requirements. However, many existing AES implementations are often designed for specific applications, lack versatility, and cannot effectively respond to changing security requirements.

[0006] The inadequacy of existing in-vehicle systems in terms of security auditing and certification is also a prominent problem. Although the AES algorithm itself is widely recognized as a secure encryption standard, its security also depends on the management and use of keys. If the generation, storage and distribution of keys are not secure enough, the application effect of AES will be greatly reduced. However, many in-vehicle systems are weakly designed in terms of key management, and fail to effectively protect and audit keys, resulting in potential security vulnerabilities.

[0007] With the development of quantum computing technology, the security of the existing AES algorithm may face new challenges. Quantum computers can theoretically effectively crack the currently widely used encryption algorithms, including AES. Therefore, the encryption scheme of the vehicle system needs to consider future technological developments and deploy quantum-safe encryption algorithms in advance to ensure its long-term security. Therefore, there is an urgent need for a small white box AES algorithm for vehicle systems. Summary of the invention

[0008] The present invention proposes a small white-box AES algorithm for an in-vehicle system, which solves the problems in the prior art that the white-box AES algorithm occupies too much space and the AES algorithm cannot protect the secret key.

[0009] The technical solution of the present invention is implemented as follows: a small white box AES algorithm for an in-vehicle system, including generating a trusted root in the vehicle through white box AES encryption, performing encryption and decryption operations through the trusted root, first performing the AES basic encryption process, setting the intermediate value variable state to a byte array, then performing round key addition, performing byte replacement after XORing the intermediate value state and the round key, mapping through the S box, and then starting row shifting, performing substitution between bytes inside the intermediate value state matrix, performing column confusion after completing the substitution, performing a reversible matrix on the intermediate value, each action affects a column of the intermediate value state, repeating the above operations, and completing 10 rounds of encryption, wherein the encryption process determines the ratio of the confusion table and algorithm restoration used in the encryption process according to CipherState, and then encrypts through the confusion table query method, and restores part of the confusion table to the algorithm to participate in the encryption and decryption process; the AES algorithm key is protected by a white box, and a corresponding rom is performed for the specific version of the vehicle computer.

[0010] The "small white-box AES algorithm for vehicle-mounted systems" of this application is significantly innovative in the prior art, especially in its design concept, implementation method and optimization for specific application scenarios. Compared with the traditional AES encryption algorithm, the white-box AES algorithm of this application not only focuses on the security of encryption, but also pays more attention to the effectiveness and adaptability in the vehicle-mounted environment.

[0011] This algorithm solves the urgent security needs of vehicle-mounted systems through the design concept of "white box AES encryption to generate a trusted root in the vehicle". Traditional AES algorithms usually rely on the secure storage and management of keys, but in the vehicle environment, the security of keys faces many challenges, such as physical attacks and reverse engineering. By creating a trusted root, the algorithm can establish a secure execution environment in the vehicle system to ensure the security of encryption and decryption operations. This design is relatively rare in the existing technology, especially in the field of vehicle-mounted systems, and usually does not fully consider how to protect the security of keys in a complex operating environment.

[0012] In the implementation process of the algorithm, the basic AES encryption process is first performed. After setting the intermediate value variable state as a byte array, encryption is performed using steps such as round key addition, byte replacement, row shift, and column confusion. This meticulous processing method ensures the comprehensiveness and complexity of the encryption process and enhances the anti-attack ability of the encryption result. Especially in the design of "encryption by obfuscation table query", compared with the traditional AES implementation, this algorithm introduces dynamic query of the obfuscation table, which increases the unpredictability of the encryption process and makes it difficult for attackers to obtain key information by analyzing the encryption results.

[0013] At each step of the encryption process, the algorithm determines the ratio of using the obfuscation table to algorithm restoration based on CipherState, further optimizing the flexibility and security of encryption. This innovation is relatively rare in the prior art. The usual AES implementation is fixed and lacks adaptability to specific operating states. This application dynamically adjusts the use of the obfuscation table so that the encryption process can respond to different security requirements and attack risks in real time, thereby improving overall security.

[0014] This application also specifically designs the "corresponding ROM to the specific version of the vehicle computer" so that the algorithm can be optimized for specific hardware. This design not only improves the operating efficiency of the algorithm on specific devices, but also ensures the pertinence and effectiveness of the encryption process. Traditional encryption algorithms are usually general and lack optimization for specific application scenarios, which may lead to performance bottlenecks or security risks in actual applications. This algorithm can better meet the needs of the vehicle environment and improve security and performance by deeply integrating with the hardware of the vehicle system.

[0015] The design of the white-box AES algorithm solves the technical problems of data protection in vehicle-mounted systems. With the intelligence and networking of vehicle-mounted systems, data security issues are becoming more and more important, and traditional encryption methods are difficult to meet the growing security needs. The white-box AES algorithm proposed in this application provides an effective solution through innovative design and targeted optimization to ensure that the vehicle-mounted system can operate safely and reliably in complex environments.

[0016] As a preferred implementation, the restoration algorithm first removes redundant calculation tables to reduce the size of the confusion table by removing redundant tables; performs algorithm optimization to reduce the use of unnecessary confusion tables, and performs algorithm configuration through optimization and algorithm restoration to adjust the size of the space occupied by the algorithm.

[0017] As a preferred implementation, the size of the obfuscation table is reduced from more than 700KB to 4.5KB through optimization and algorithm restoration, allowing the algorithm to run normally while ensuring the encryption security of the algorithm.

[0018] As a preferred implementation, the byte array is a two-dimensional byte array, which becomes a 4x4 array after being expanded, and when round key addition is performed, the intermediate value state is XORed with the 16-byte round key.

[0019] As a preferred implementation, when the S-box performs mapping, any byte in the array is marked, and the mapping of the marked byte to another byte is completed through the S-box.

[0020] As a preferred implementation, the column-confused intermediate value state is left-multiplied by a reversible matrix over a finite field, and each action affects 4 bytes in a column of the intermediate value state.

[0021] After adopting the above technical solution, the beneficial effect of the present invention is that the beneficial effect of applying the small white box AES algorithm in the vehicle system is mainly reflected in the following aspects. The algorithm can effectively improve the security of data and protect the sensitive information of the vehicle, such as the user's personal data, vehicle positioning information and vehicle network communication data, through a powerful encryption mechanism. This security can not only prevent data from being accessed without authorization, but also enhance the user's trust in the vehicle system and promote the popularization and development of smart cars. Due to its strong design adaptability, the small white box AES algorithm can run efficiently on resource-constrained embedded devices, reduce the power consumption and resource requirements of the system, and thus improve the overall performance and response speed of the vehicle system. This high efficiency is crucial for real-time applications, and can ensure that the vehicle can still quickly process and encrypt important data when driving at high speed. At the same time, the algorithm has a certain resistance to side channel attacks. By optimizing the hardware implementation, the risk of being attacked is reduced, and the security of the vehicle system is further enhanced. The flexible key management mechanism enables the system to securely generate, store and distribute keys, thereby ensuring the reliability of the encryption process. This mechanism not only improves the overall security of the system, but also simplifies the complexity of key management and reduces potential human errors. Finally, with the development of quantum computing technology in the future, the security design of the small white box AES algorithm can also be adjusted and upgraded accordingly to ensure that it can still maintain effective protection capabilities when facing new types of attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0023] Figure 1 This is a schematic diagram of state byte replacement and row shift transformation performed by the present invention;

[0024] Figure 2 The present invention adopts a specific embodiment to perform left multiplication of the array by state to obtain the confusion result. DETAILED DESCRIPTION

[0025] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0026] Example:

[0027] like Figure 1 As shown, a small white box AES algorithm for an in-vehicle system includes generating a trusted root in the vehicle through white box AES encryption, performing encryption and decryption operations through the trusted root, first performing the basic AES encryption process, setting the intermediate value variable state to a byte array, then performing round key addition, performing byte replacement after XORing the intermediate value state and the round key, mapping through the S box, and then starting row shifting, performing substitution between bytes inside the intermediate value state matrix, performing column confusion after the substitution, making the intermediate value a reversible matrix, and each action affecting a column of the intermediate value state, repeating the above operations, and completing 10 rounds of encryption, wherein the encryption process determines the ratio of the confusion table and the algorithm restoration used in the encryption process according to CipherState, and then encrypts through the confusion table query method, and restores part of the confusion table to the algorithm to participate in the encryption and decryption process; the AES algorithm key is protected by the white box, and the corresponding rom is performed for the specific version of the vehicle computer.

[0028] The purpose of designing the small white-box AES algorithm for in-vehicle systems is to ensure the security and privacy of in-vehicle data. The key to white-box encryption is to embed the key and the implementation of the encryption algorithm into the application, so that even if the attacker obtains the binary code of the program, it is difficult to extract the key. The algorithm ensures the security and reliability of data in the in-vehicle environment by generating a trusted root in the vehicle and performing encryption and decryption operations based on it.

[0029] First of all, the working principle of the algorithm is based on AES (Advanced Encryption Standard), which is a widely used symmetric encryption algorithm that can effectively protect data security. The main innovation of white box AES is to combine the traditional AES algorithm with white box technology to form a system that integrates data encryption and key protection. In specific operations, the trusted root in the car is first generated through white box AES encryption. The trusted root is a secure basic component that is responsible for subsequent encryption and decryption operations. Its generation is the first step to ensure the security of the entire system.

[0030] When encrypting, the algorithm first executes the basic encryption process of AES. During this process, an intermediate value variable state is set, which is set to a byte array to represent the data to be encrypted. Next, the algorithm executes the step of round key addition. Round key addition is the first step in the AES encryption process. It mainly achieves preliminary obfuscation of data by performing an XOR operation on the intermediate value state and the current round key. The core of this operation is to increase the complexity of encryption by introducing a key, making it difficult for an attacker to infer the key even if he knows the correspondence between certain plaintext and ciphertext.

[0031] The algorithm then performs byte replacement and mapping through the S-box. The S-box is a fixed lookup table that is responsible for nonlinear transformation of bytes, thereby further increasing the security of encryption. The next row shift step increases the diffusion of data by replacing the internal bytes of the intermediate value state matrix, so that each output byte is associated with multiple input bytes.

[0032] After completing the row shift, the algorithm performs column confusion. Figure 2 As shown, Figure 2 The result shown is the following array obfuscated by left-multiplying state:

[0033]

[0034] The column obfuscation process uses a reversible matrix to process the intermediate values. Each operation affects a column of the state. This design further increases the complexity of the encryption process. By repeating the above steps, 10 rounds of encryption are completed. Each round is designed to increase the strength of encryption and ensure the security of data during transmission and storage.

[0035] During the encryption process, the algorithm also determines the ratio of the obfuscation table used and the algorithm restoration according to the state of CipherState. The role of the obfuscation table is to provide a set of predefined replacement rules that can effectively enhance the obfuscation of data. By looking up the obfuscation table, the algorithm can restore part of the obfuscation table as part of the algorithm during the encryption process and participate in the encryption and decryption process. This design can further improve the flexibility and security of the system.

[0036] It is worth noting that white-box AES not only focuses on the security of the encryption process, but also has a special design for the protection of the secret key. Through the white-box protection mechanism, the algorithm can effectively prevent the secret key from being reversely extracted or cracked. Specifically, for different versions of the car computer, the algorithm will generate a corresponding ROM (read-only memory) to ensure that the secret key and implementation logic of each version are different, so that even if an attacker obtains a certain version of the ROM, he cannot use it to crack the secret key of other versions.

[0037] The restoration algorithm first removes redundant calculation tables to reduce the size of the confusion table by removing redundant tables; performs algorithm optimization to reduce the use of unnecessary confusion tables, and configures the algorithm through optimization and algorithm restoration to adjust the size of the space occupied by the algorithm.

[0038] Traditional AES implementations usually use fixed-size obfuscation tables, which may contain a lot of redundant information, resulting in a waste of storage space. By eliminating redundant calculation tables, the algorithm can significantly reduce the size of the obfuscation table, thereby optimizing the use of storage resources. This process not only improves the algorithm's operating efficiency, but also reduces memory usage, which is particularly important in embedded systems with limited resources.

[0039] In the prior art, designers often overlook the dynamic adjustment and optimization of the obfuscation table, resulting in low execution efficiency in different environments. In this embodiment, by intelligently detecting redundant information and eliminating unnecessary calculation tables in real time, it can be ensured that only the most effective obfuscation information is used for each encryption operation. This dynamic optimization method not only improves the adaptability of the encryption process, but also reduces potential security risks, because attackers may find it easier to find opportunities to crack by analyzing the complexity of the obfuscation table. Therefore, while improving security, this embodiment also provides new ideas for the flexibility and applicability of the algorithm.

[0040] Through optimization and algorithm restoration, the size of the obfuscation table was reduced from more than 700KB to 4.5KB, allowing the algorithm to run normally while ensuring the encryption security of the algorithm.

[0041] The main difference from the existing technology lies in the balance between storage efficiency and algorithm execution. Traditional AES implementations usually rely on large and fixed obfuscation tables, which ensure the complexity of encryption to a certain extent, but also lead to a large occupation of storage space. In embedded devices or vehicle systems, storage resources are usually very limited, so how to find a balance between ensuring security and reducing storage occupancy has become the key to the design.

[0042] Through the optimization of this implementation, the size of the obfuscation table is compressed to 4.5KB, showing a great saving in storage resources. This significant compression not only improves the algorithm's operating efficiency on low-resource devices, but also reduces the burden of data transmission and improves overall performance. Compared with the prior art, this implementation demonstrates how to achieve optimal resource utilization through efficient algorithm design without sacrificing security. This effective management of storage resources can enable the white-box AES algorithm to be used on more types of hardware, thereby expanding its scope of application.

[0043] The byte array is a two-dimensional byte array, which becomes a 4x4 array after being expanded. When the round key is added, the intermediate value state is XORed with the 16-byte round key.

[0044] Traditional AES algorithms usually use one-dimensional arrays or other complex data structures to store state information, which may lead to complexity of operation and reduced efficiency in implementation. In this embodiment, a two-dimensional byte array is used and flattened into a 4x4 array, making the operation of each byte more intuitive and easy to manage.

[0045] This design not only simplifies data management during encryption, but also improves readability and maintainability during encryption and decryption. When performing round key addition, directly performing XOR operations with the 16-byte round key can more clearly represent the transformation process of each step. This intuitive data structure design helps with subsequent algorithm optimization and modification, reducing the difficulty of development and maintenance. In addition, the use of a fixed 4x4 array structure helps parallel processing of the algorithm during hardware implementation, effectively improving the calculation speed.

[0046] When the S box performs mapping, any byte in the array is marked, and the mapping of the marked byte to another byte is completed through the S box.

[0047] In the traditional AES algorithm, the mapping of the S box is static, and the replacement rules of all bytes are fixed when the algorithm is designed. Although this fixed mapping method is safe, it may lead to reduced efficiency in some cases.

[0048] By introducing a dynamic tagging mechanism, the algorithm can selectively map bytes according to actual needs. This design not only improves the flexibility of the encryption process, but also generates different encryption results based on different input data, increasing the complexity and security of the algorithm. The introduction of dynamic tags makes it difficult for attackers to predict the mapping rules when analyzing ciphertext, thereby improving the system's ability to resist attacks. Compared with existing technologies, this flexible design idea demonstrates how to improve algorithm efficiency and adaptability while ensuring security, especially when facing a variety of attack methods.

[0049] The column-confused intermediate value state is left-multiplied by a reversible matrix over a finite field, and each action affects 4 bytes in a column of the intermediate value state.

[0050] The column obfuscation operation in the traditional AES algorithm is usually based on a fixed linear transformation. Although this transformation is effective, it may be vulnerable to complex attacks.

[0051] By introducing a reversible matrix on a finite field, the algorithm can implement more complex and diverse column obfuscation operations. This design not only strengthens the mathematical foundation of the encryption process, but also improves the security of the system, because the transformations performed on a finite field are more unpredictable. Each operation affects the 4 bytes in a column of the intermediate value state, thereby further enhancing the diffusion and obfuscation of the data. This design idea can effectively improve the algorithm's resistance to attacks and ensure the security of data during transmission and storage.

[0052] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A small white-box AES algorithm for in-vehicle systems, It is characterized in that It includes generating a trusted root in the car through white-box AES encryption, performing encryption and decryption operations through the trusted root, and first performing the basic AES encryption process. By setting the intermediate value variable state, it is set to a byte array, and then the round key is added. The intermediate value state and the round key are XORed and then replaced by bytes. Mapping is performed through the S box, and then row shifting is started. The bytes inside the intermediate value state matrix are replaced. After the replacement is completed, column confusion is performed, and the intermediate value is reversible. Each action affects a column of the intermediate value state. The above operations are repeated to complete 10 rounds of encryption. The encryption process determines the ratio of the obfuscation table and the algorithm restoration used in the encryption process according to the CipherState, and then encryption is performed through the obfuscation table query method. Part of the obfuscation table is restored to the algorithm to participate in the encryption and decryption process; the AES algorithm key is protected by a white box, and the corresponding rom is performed for the specific version of the vehicle computer.

2. A small white box AES algorithm for an in-vehicle system as claimed in claim 1, Features: The restoration algorithm first removes redundant calculation tables to reduce the size of the confusion table by removing redundant tables; performs algorithm optimization to reduce the use of unnecessary confusion tables, and configures the algorithm through optimization and algorithm restoration to adjust the size of the space occupied by the algorithm.

3. A small white box AES algorithm for an in-vehicle system as claimed in claim 2, Features: Through optimization and algorithm restoration, the size of the obfuscation table was reduced from more than 700KB to 4.5KB, allowing the algorithm to run normally while ensuring the encryption security of the algorithm.

4. A small white box AES algorithm for an in-vehicle system as claimed in claim 1, Features: The byte array is a two-dimensional byte array, which becomes a 4x4 array after being expanded. When the round key is added, the intermediate value state is XORed with the 16-byte round key.

5. A small white box AES algorithm for an in-vehicle system as claimed in claim 1, Features: When the S box performs mapping, any byte in the array is marked, and the mapping of the marked byte to another byte is completed through the S box.

6. A small white box AES algorithm for an in-vehicle system as claimed in claim 1, Features: The column-confused intermediate value state is left-multiplied by a reversible matrix over a finite field, and each action affects 4 bytes in a column of the intermediate value state.

Images