Key security assessment method for white box encryption and computing device

Abstract

A key security assessment method for white box encryption and a computing device, comprising: determining a first relationship between a first probability of speculating a correct key and the number of memory traces according to a first simulation process of speculating a key from memory traces in a target attack mode, the memory traces are a data set of an intermediate state generated in an encryption process of a target encryption system, according to the first relationship, carrying out reverse deduction to obtain a first number of the memory traces enabling the first probability to meet a target probability, and according to the first number, evaluating the security of the target encryption system, according to the method, the security of the white-box encryption system in different attack modes is quantitatively expressed by using the key life cycle, a method for measuring the security of the white-box encryption system is provided, and further, guidance can be provided for a user to improve the security of the white-box encryption system.

Description

Technical Field

[0001] The embodiments of this specification belong to the field of data processing technology, and more particularly, relate to a key security assessment method and computing device for white-box encryption. Background Art

[0002] The white-box encryption solution is designed to achieve encryption in a white-box attack environment and protect the key from being obtained by attackers. It has applications in fields such as Internet of Things security and digital rights management.

[0003] Unlike a black-box attack environment where attackers can only obtain the input and output of the entire encryption process, in a white-box attack environment, attackers have a higher degree of control over the encryption process. They can not only obtain the input and output of each sub-computation step in the complete encryption process, but can even decompile the encryption program to obtain the encryption algorithm.

[0004] Undoubtedly, the keys in the white-box encryption scheme face higher security risks. In order to ensure the security of the white-box encryption scheme, the present invention provides a key security assessment method and computing device for white-box encryption. Summary of the Invention

[0005] The present invention aims to provide a key security assessment method and computing device for white-box encryption, comprising:

[0006] In a first aspect, this specification provides a key security assessment method for white-box encryption, the method comprising:

[0007] determining, based on a first simulation process of inferring a key from memory traces in a target attack mode, a first relationship between a first probability of inferring a correct key and a number of memory traces, wherein the memory traces are a data set of intermediate states generated during an encryption process of the target encryption system;

[0008] According to the first relationship, reverse deduction is performed to obtain a first number of memory traces that makes the first probability meet the target probability;

[0009] The security of the target encryption system is evaluated based on the first quantity.

[0010] In some implementations, determining a first relationship between a first probability of inferring a correct key and a number of memory traces includes:

[0011] Determining multiple candidate keys;

[0012] For any candidate key, use the candidate key to process a plurality of data to be encrypted to generate prediction data, determine a first degree of match between the prediction data and a current number of memory traces corresponding to the plurality of data to be encrypted; and determine a second probability that the candidate key is evaluated as a recommended key based on the first degree of match;

[0013] The first probability is determined according to the second probability corresponding to each candidate key, thereby obtaining the first relationship.

[0014] In some implementations, for any data to be encrypted, corresponding predicted data includes a number of bytes; and determining a first degree of match between the predicted data and a current number of memory traces corresponding to the plurality of data to be encrypted includes:

[0015] For any data to be encrypted, each byte in the predicted data corresponding to the data to be encrypted is processed using the preset selection parameters to obtain the predicted result corresponding to the data to be encrypted; each byte in the memory trace corresponding to the data to be encrypted is processed using the preset connection parameters to obtain the actual result corresponding to the data to be encrypted;

[0016] Determine a sequence matching degree between a prediction result sequence formed by the prediction results of each of the plurality of data to be encrypted and an actual result sequence formed by the actual results, and determine the first matching degree based on the sequence matching degree.

[0017] In some implementations, determining, based on the first degree of matching, a second probability that the candidate key is evaluated as a recommended key specifically includes:

[0018] A second probability that the candidate key is evaluated as a recommended key is determined based on the multiple first matching degrees respectively determined under the multiple selection parameters.

[0019] In some implementations, determining a second probability that the candidate key is evaluated as a recommended key based on multiple first matching degrees determined under multiple selection parameters specifically includes:

[0020] Determining, based on the multiple first matching degrees, a probability that the candidate key is evaluated as a recommended key under the multiple selection parameters as a second probability that the candidate key is evaluated as a recommended key; or

[0021] According to the multiple first matching degrees, a probability that the candidate key is evaluated as a recommended key under at least one selection parameter is determined as a second probability that the candidate key is evaluated as a recommended key.

[0022] In some implementations, determining the first degree of matching based on the sequence matching specifically includes:

[0023] The first matching degree is determined according to multiple sequence matching degrees determined under multiple connection parameters.

[0024] In some implementations, wherein

[0025] The degree of sequence matching corresponding to the correct key depends on the correlation between the protected output memory trace and the unprotected sensitive data under the protection method adopted by the target encryption system. The higher the correlation, the higher the expected degree of sequence matching.

[0026] In some implementations, inversely calculating, based on the first relationship, to obtain a first number of memory traces that causes the first probability to meet a target probability specifically includes:

[0027] According to the first relationship, the first number of memory traces that makes the second probability corresponding to the correct key meet the target probability and the second probability corresponding to the incorrect key meet the preset attack deviation probability is obtained by reverse deduction.

[0028] In some implementations, inversely calculating, based on the first relationship, to obtain a first number of memory traces that causes the first probability to meet a first target probability specifically includes:

[0029] randomly determining a second number of memory traces until a first probability corresponding to the second number is determined to be not less than the target probability according to the first relationship;

[0030] By using a binary search, a first quantity whose corresponding first probability matches the target probability is determined among the quantities below the second quantity.

[0031] In some implementations, evaluating the security of the target encryption system based on the first quantity includes:

[0032] The key life cycle of the target encryption system is determined according to the first number; the longer the key life cycle is, the higher the security of the target encryption system is.

[0033] A second aspect of this specification provides a computing device, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method described in the first aspect is implemented.

[0034] The key security assessment for white-box encryption provided in this embodiment can use the key life cycle to quantify the security of the white-box encryption system under different attack modes, providing a measurement method for the security of the white-box encryption system. Furthermore, it can also provide guidance for users to improve the security of the white-box encryption system. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the technical solutions of the embodiments of this specification, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0036] Figure 1 is a flow chart of the first simulation process in one embodiment of this specification;

[0037] Figure 2 1 is a schematic diagram of the probability distribution of the number of successful matches corresponding to an incorrect key and a correct key in one embodiment of this specification;

[0038] Figure 3 This is a flowchart of a key security assessment method for white-box encryption in an embodiment of this specification;

[0039] Figure 4 This is a schematic diagram of output data of each calculation stage of the white box encryption system in the theoretical state after protection and without protection in an embodiment of this specification;

[0040] Figure 5 This is a schematic diagram of the binary search process in one embodiment of this specification. DETAILED DESCRIPTION

[0041] To help those skilled in the art better understand the technical solutions in this specification, the following will provide a clear and complete description of the technical solutions in the embodiments of this specification, in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of this specification, not all of them. All other embodiments derived by those skilled in the art based on the embodiments in this specification without creative effort shall fall within the scope of protection of this specification.

[0042] As mentioned earlier, to adapt to insecure encryption environments, researchers have proposed the concept and algorithms of white-box cryptography. In white-box cryptography, the concept assumes the existence of a white-box attack environment, where an attacker can obtain not only the input and output of the encryption algorithm but also the intermediate data during the encryption process. Furthermore, the attacker has the ability to track the executed code and feed data an unlimited number of times to guess the key. To address such white-box attack environments, current research focuses on improving encryption algorithms to enhance their resilience and reduce the probability of obtaining the key through attacks. However, in practice, it is always difficult to propose a convincing and ideal white-box cryptographic algorithm that ensures the secure implementation of the encryption process under white-box attack environments.

[0043] After research, the inventors discovered that a major cause of this dilemma is that white-box cryptography assumes an attacker with virtually unlimited power, capable of performing arbitrary operations on the software programs that implement the cryptographic algorithms. However, the inventors observed that this characteristic does not hold true in normal industrial use. In typical operational practices, encryption software programs can always be protected to a certain degree through known means, avoiding the creation of a pure white-box attack environment. Therefore, research on the protection of encryption programs in weak white-box environments is of greater practical significance.

[0044] To this end, the inventors proposed a weak white-box attack model—the memory trace attack model. Under this model, the attacker's success rate against a white-box cryptographic system is quantifiable. Furthermore, this success rate can be used to assess the security of the keys used in the white-box cryptographic system.

[0045] For the sake of clarity, the following will first explain the professional terms that may be involved in this specification.

[0046] Memory trace: A collection of data representing the intermediate states generated during the execution of a software program. In the context of encryption, a memory trace can be the intermediate states of each intermediate step in an encryption algorithm. It should be noted that in a white-box cryptographic system, each intermediate step is processed by a protection scheme. The memory trace differs from the actual state generated during the execution of a standard cryptographic algorithm without such protection schemes. Therefore, an attacker cannot directly and accurately determine the encryption parameters used in the white-box cryptographic system based on the memory trace.

[0047] Sensitive variables: Real variables generated during the execution of an unprotected cryptographic algorithm. In the target encryption system, sensitive variables are not actually generated due to the existence of the protection scheme.

[0048] Anti-reverse engineering: Reverse engineering is a technical means of dissecting and analyzing a product to obtain information such as its design principles, technical parameters, and manufacturing processes. In the field of white-box encryption, reverse engineering can be used by attackers to obtain the operating permissions and internal code of the white-box encryption system. Anti-reverse engineering is a technical means to counter reverse engineering, which can be specifically divided into hardware and software levels. Among them, technical means at the hardware level may include encryption chip technology, physical uncloning technology, anti-tampering sensor technology, etc.; technical means at the software level may include code obfuscation technology, digital signature and authentication technology, configuration file encryption technology, etc.

[0049] Memory trace attack model: First of all, it should be noted that for white-box encryption systems, the attacker's attack goal is to obtain the correct key. For example, in the IoT scenario, after obtaining the correct key, the attacker can use the correct key to disguise the terminal device and send false messages to the IoT system. The memory trace attack model is an abstract model of the attacker's attack method proposed in this specification. The memory trace attack model has the following characteristics: (1) The attacker can only obtain memory trace information and the corresponding plaintext and ciphertext, and the white-box encryption system does not leak other information; (2) The attacker can only collect memory traces through the normal execution of the encryption process; (3) The plaintext (ciphertext) used in encryption (decryption) is not selected by the attacker and is considered to be a random value that obeys a uniform distribution from the attacker's perspective; (4) There is no strict limit on the time complexity of the attack.

[0050] S-Box: An S-Box is a nonlinear transformation component that maps input plaintext data (usually in binary form) and a key to output ciphertext data. This mapping is predefined and typically stored in a table. An S-Box allows an attacker to simulate the encryption process of the encrypted data using a candidate key.

[0051] Protection Scheme: Unlike reverse engineering protection, the goal of implementing a protection scheme is to prevent attackers from directly accessing sensitive variables in a white-box cryptosystem. Without a protection scheme, the memory traces captured by an attacker are equivalent to sensitive variables, allowing the attacker to directly obtain the correct key based on the memory traces. Common protection schemes include encoding, masking, and virtual shuffling.

[0052] Encoding scheme: Sensitive variables are transformed using linear and then nonlinear encoding layers. The transformed results are the actual outputs in the memory trace. Sensitive variables can be recovered through reverse encoding during the subsequent encryption process.

[0053] Masking: Split the sensitive variable into its own sub-variables. The result of the split is the actual output in the memory trace. For example, for a sensitive variable, the split result can be n sub-variables. These n sub-variables are connected by XOR or dot product operations to obtain the sensitive variable.

[0054] Virtual Shuffling Scheme: For a piece of data to be encrypted, n virtual data are randomly generated. These n virtual data are encrypted simultaneously with the data to be encrypted. However, the virtual data are not actually encrypted, resulting in n pre-programmed virtual encryption results. The output in the memory trace is each virtual encryption result and the sensitive variable (i.e., the actual encryption result). Subsequent steps can then eliminate the influence of each virtual encryption result according to pre-programmed rules. For example, the XOR result of these n variables can be preset to 0. Because the input in the memory trace includes not only the data to be encrypted but also the virtual data, attackers cannot directly access the data to be encrypted and the sensitive variables.

[0055] Key life cycle: proposed by the present invention, it represents the amount of encrypted data that can be encrypted using the same key in a white box encryption system while meeting security requirements.

[0056] Figure 1 The flowchart of the first simulation process in an embodiment of this specification is shown below. The first simulation process is described from the perspective of a simulated attacker. First, in the acquisition phase, the attacker acquires the encryption process of the target encryption system and collects multiple data to be encrypted. Here, the number of batches of data to be encrypted is recorded as N. t , the corresponding collection of the N t N corresponding to the batch of data to be encrypted t Batch memory trace, this N t The batch memory trace is taken as an actual result sequence; the following is the prediction stage, in which the attacker determines multiple candidate keys. Since the processing for each candidate key is the same, here we take one candidate key as an example and use it to process N t The batch of data to be encrypted generates the prediction data corresponding to each batch of data to be encrypted (using the selected key to process the data to be encrypted can be achieved using the S box), and the N t The batch prediction data is treated as a prediction result sequence. The next phase is the comparison phase, where the attacker matches the prediction result sequence with the actual result sequence. This involves matching the prediction data corresponding to the same batch with the memory trace and determining the number of successful matches, denoted as T. Furthermore, based on the number of successful matches corresponding to each candidate key, the recommended key (i.e., the correct key determined by the attacker) is determined from the candidate keys.

[0057] It should be noted that in the memory trace attack model, the attacker can know in advance the types of encryption and protection algorithms used by the target encryption system. (Of course, the attacker cannot know the code implementation of the encryption and protection algorithms and cannot obtain other information other than the memory trace.) Therefore, the total number of candidate keys is determined by the format of the current key in the white-box encryption system. For example, if the current key in the white-box encryption system is an 8-bit key (8-bit binary number), the number of candidate keys can be 256, covering all possible values of the current key.

[0058] According to the aforementioned first simulation process, the attacker determines whether a candidate key should be used as a recommended key based on the number of successful matches. The definition of a successful match is introduced in detail below to derive the first relationship between the first probability of inferring the correct key and the number of memory traces.

[0059] If a candidate key is a wrong key, that is, the candidate key is irrelevant to the current key, the predicted data obtained by simulating the candidate key is also irrelevant to the memory trace actually collected during the encryption process. Therefore, for a wrong key, whether the predicted data of the wrong key matches the memory trace is completely random. For example, for the candidate key, the predicted data corresponding to a data to be encrypted is represented as a bit, and the memory trace corresponding to the data to be encrypted is also represented as a bit, then the probability that the predicted data matches the memory trace is 50% (since the wrong key is irrelevant to the current key, the predicted data can be regarded as a random value between 0 and 1, and the memory trace is considered to be a random value that obeys a uniform distribution from the attacker's perspective based on the above assumptions, and also randomly takes values between 0 and 1. The probability that the predicted data is the same as the memory trace is 50%). That is, the number of successful matches of the wrong key is T w Obey the following distribution:

[0060]

[0061] in, represents the probability density function of the normal distribution; μ represents the mean; σ 2 Represents variance.

[0062] On the other hand, if a candidate key is the correct key, the predicted data is a sensitive variable. Even if the target encryption system adopts a protection scheme, there is a certain correlation between the sensitive variable and the memory trace output after protection during the encryption process. That is, for the correct key, whether the predicted data of the correct key matches the memory trace is not completely random. Continuing with the above example, the predicted data corresponding to a piece of data to be encrypted is represented as a bit, and the memory trace corresponding to the piece of data to be encrypted is also represented as a bit, then the probability of the predicted data matching the memory trace will obviously deviate from 50% (due to the correlation between the current key and the current key, the predicted data is not randomly selected between 0 and 1, but will produce an obvious bias towards one of them. According to the above assumptions, the memory trace is still considered to be a random value that obeys a uniform distribution from the attacker's perspective. It randomly selects between 0 and 1, and the probability that the predicted data is the same as the memory trace will obviously not be 50%). That is, the correct key T r The number of successful matches follows the following distribution:

[0063]

[0064] Here, Cor represents the correlation between the sensitive variable and the memory trace. This correlation can be determined according to the type of protection scheme. The interpretation of other parameters can refer to other formulas.

[0065] Therefore, using the idea of hypothesis testing, it can be determined whether a candidate key should be recommended as a candidate key. Figure 2 The figure shows the probability distribution of the number of successful matches of the wrong key and the correct key. The dotted line A is the probability density curve of the wrong key, and the solid line B is the probability density curve of the correct key. As shown in the figure, when the selected key is the wrong key, T w The value deviation The farther away, the lower the probability of this value. Conversely, when there is a deviation For a value that is far enough away, since the probability of occurrence of this value is too low, it can be considered that the wrong key does not support the occurrence of this value, that is, the candidate key is not a wrong key (that is, the candidate key should be evaluated as a recommended key).

[0066] Figure 2 The deviation judgment standard, that is, the matching threshold, is marked as c, which also represents the difference between The distance between the two keys is c. The portion of curve B to the right of the matching threshold represents the probability that the correct key is evaluated as the recommended key, and the portion of curve A to the right of the matching threshold represents the probability that the incorrect key is evaluated as the recommended key (under strict conditions, the correlation between sensitive data and memory traces is positive, so only the portion greater than the matching threshold needs to be considered).

[0067] If the only criterion for determining whether the attacker has deduced the correct key is that the correct key is evaluated as the recommended key, then the first relationship between the first probability of deducing the correct key and the number of required memory traces can be determined according to the following formula:

[0068]

[0069] Among them, P s represents the probability that the correct key is evaluated as the recommended key, the P s Corresponding It can also be understood as the sequence matching degree corresponding to the correct key; Φ(·) represents the probability distribution function of the normal distribution, and other parameters can refer to other formulas. When using formula (3) to determine the first quantity, P s The value of can be set by the user, representing the target probability of the key being cracked that the user can accept; the matching threshold c can also be set by the user, representing the user's assumption about the attacker's attack bias (if the matching threshold is set too small, the wrong key may also be evaluated as the recommended key, and recommending multiple keys at the same time may also be regarded as the attacker's failure to infer the correct key).

[0070] More rigorously, the attacker expects only the correct key to be recommended, and the probability of the wrong key being evaluated as the recommended key should be as small as possible, while the probability of the correct key being evaluated as the recommended key should be as large as possible. Then, the first relationship between the first probability of inferring the correct key and the number of memory traces can be determined by combining formula (3) and the following formula:

[0071]

[0072] Among them, P w represents the probability that the wrong key is evaluated as the recommended key. Of course, the P w Corresponding It can also be understood as the sequence matching degree corresponding to the wrong key; the interpretation of other parameters can refer to other formulas.

[0073] When the first quantity is determined using formula (3) and formula (4), P s The value of can be set by the user, representing the target probability of the key being cracked that the user can accept for the attacker; P w The value of can be set by the user, representing the attack deviation probability of the user for the attacker's attack deviation hypothesis. Since c in the above two equations has the same meaning, the user-set value can be substituted and the two equations can be solved to obtain c and N t , solve for N t That is the first quantity.

[0074] Of course, a more universal condition is that the correlation between sensitive data and memory traces can be positive or negative. It is easy to understand that according to the aforementioned matching method (where the predicted data and memory trace corresponding to a piece of data to be encrypted are both represented as one bit), if the sensitive data and memory trace corresponding to each piece of data to be encrypted do not mismatch, then it is obvious that the sensitive data and memory trace also have a strong correlation. Therefore, formula (3) can be generalized to formula (5), and formula (4) can be generalized to formula (6):

[0075]

[0076] The process of determining the first quantity according to formulas (5) and (6) can refer to formulas (3) and (4), which will not be described in detail here.

[0077] Figure 3 A flowchart of a key security assessment method for white-box encryption in an embodiment of this specification is shown. The method can be executed by any computing device with computing capabilities and is not limited in this specification. The method includes:

[0078] S301: Determine a first relationship between a first probability of inferring a correct key and the number of memory traces according to a first simulation process of inferring a key from memory traces in a target attack mode, where the memory traces are a data set of intermediate states generated during the encryption process of the target encryption system.

[0079] The target attack mode may be, for example, various attack modes that conform to the aforementioned first simulation process, such as differential computation analysis (DCA), white-box learning parity with noise (WBLPN), etc.

[0080] On the other hand, this specification does not limit the encryption algorithm used by the target encryption system. The encryption algorithm may be, for example, an encryption algorithm such as the Advanced Encryption Standard (AES) or the Triple DES (3DES). For example, when AES encryption is used, the corresponding encryption parameters may include a lookup table LUT embedded with key information, such as a T table, a Ty table, etc. In some embodiments, the above encryption algorithm may also be a white-box encryption algorithm that has undergone certain white-box protection based on a standard encryption algorithm, such as the white-box AES algorithm proposed by Chow et al. This specification does not specifically limit the encryption algorithm used in this link.

[0081] Specifically, the computing device may be pre-deployed with a computing program for the aforementioned formulas corresponding to the first relationship. It should be noted that since the white box encryption system may use more than one protection scheme and more than one feasible attack mode, when executing the following example: Figure 3 Before the method shown, the key parameters of the computing program affected by the protection scheme and the type of attack model are in a default state. The aforementioned key parameters may include, for example, a correlation parameter Cor.

[0082] Furthermore, when executing step S301, the computing device may determine the key parameters in the aforementioned formulas according to the attack type of the target attack pattern and the type of protection scheme in the target encryption system.

[0083] S303: According to the first relationship, reversely deduce and obtain a first number of memory traces that make the first probability meet the target probability.

[0084] As can be seen from the above, the above formulas (3), (4) and (5), (6) show P in a quantitative form. s The probability that the correct key is evaluated as the recommended key and the probability that the wrong key is evaluated as the recommended key P wOn the other hand, the attacker can use P to infer the first probability of the correct key. s With P w For example, the first probability can be expressed as the probability that only correct keys are recommended and no incorrect keys are recommended:

[0085] Therefore, the first number of memory traces for which the first probability meets the target probability can be obtained by reverse deduction using the aforementioned formulas.

[0086] S305: Evaluate the security of the target encryption system based on the first quantity.

[0087] Therefore, the user has a desired P s With P w The value setting of , that is, the user's security requirements for the target encryption system, the target probability (as mentioned above, the expected P s The higher the value of (i.e., the target probability), the higher the user's security requirements for the target encryption system. Based on the aforementioned first relationship, it can be inferred that in order to meet this security requirement, the number of memory traces generated by the target encryption system using the same key for encryption must not exceed the first number. In other words, under the same target probability constraint, the greater the first number corresponding to the target encryption system, the longer the key life cycle of the target encryption system, and accordingly, the stronger the security of the target encryption system.

[0088] It should be noted that the security of the target encryption system needs to be evaluated in combination with the first quantity and the target probability based on which the first quantity is determined. A single first quantity cannot represent the security of the target encryption system.

[0089] In some implementations, after determining the security of the target encryption system, the key update period of the target encryption system can be set according to preset security requirements, thereby providing a feasible solution for defending against memory trace attack models in actual application environments.

[0090] like Figure 3 The key security assessment method shown for white-box encryption can use the key life cycle to quantify the security of the white-box encryption system under different attack modes, providing a measurement method for the security of the white-box encryption system. Furthermore, it can also provide guidance for users to improve the security of the white-box encryption system.

[0091] Additionally, in some implementations, such as Figure 3The step S301 shown specifically includes: determining multiple candidate keys, for any candidate key, using the candidate key to process multiple data to be encrypted to generate prediction data, and determining a first degree of match between the prediction data and the current number of memory traces corresponding to the multiple data to be encrypted; based on the first degree of match, determining a second probability that the candidate key is evaluated as a recommended key, and determining the first probability based on the second probabilities corresponding to each candidate key, thereby obtaining the first relationship.

[0092] For specific implementation, please refer to the previous article Figure 1 Introduction.

[0093] In some implementations, for any candidate key, the first matching degree may correspond to the following equations (3) to (6): and

[0094] Furthermore, for any data to be encrypted, the corresponding prediction data includes several bytes. Figure 3 In step S301 shown, for any data to be encrypted, each byte in the predicted data corresponding to the data to be encrypted is processed using preset selection parameters to obtain a predicted result corresponding to the data to be encrypted; each byte in the memory trace corresponding to the data to be encrypted is processed using preset connection parameters to obtain an actual result corresponding to the data to be encrypted, and a sequence matching degree between a predicted result sequence formed by the respective predicted results of the multiple data to be encrypted and an actual result sequence formed by the actual results is determined, and the first matching degree is determined based on the sequence matching degree.

[0095] exist Figure 1 In the corresponding introduction, we provide the distribution formula (1) for the number of successful matches for a candidate key when the predicted data corresponding to the data to be encrypted is represented as one bit (of course, the memory trace is processed similarly). It is not difficult to see that representing both the predicted data and the memory trace as one bit can improve the simplicity of the subsequent formulas (3) and (4), and thus improve the efficiency of the subsequent step S303, which reversely infers the first quantity based on the first relationship.

[0096] However, in the first simulation process, for a candidate key, the predicted data corresponding to a data to be encrypted is usually composed of multiple bytes in actual situations. Therefore, it is necessary to use selection parameters to process multiple bytes in a predicted data to obtain a single byte representation to obtain a predicted result. In some implementations, the selection parameter can be expressed in the form of a sequence. For example, when the predicted data corresponding to a data to be encrypted includes 4 bytes, the selection parameter can be expressed as a sequence of length 4, such as (1, 1, 0, 0). The selection parameter means that the weight of the first byte and the second byte in the predicted data is 1, and the weight of the third byte and the fourth byte in the predicted data is 0. It can also mean that the first byte and the second byte in the predicted data are XORed to obtain the predicted result. Since the predicted result is obtained after processing the predicted data according to certain selection parameters, the predicted result still carries the information contained in the predicted data.

[0097] On the other hand, for a selected key, the memory trace corresponding to a piece of data to be encrypted is more complicated. Figure 4 A schematic diagram shows the output data of each computational phase of a white-box encryption system under both protected and unprotected theoretical conditions. As shown in the figure, the output data is the memory trace in the protected scheme and the sensitive data in the unprotected scheme. The number of small rectangles in the figure represents the number of bytes in the output data. It can be seen that due to the protection scheme, the theoretically first phase is not executed first in the protected scheme; instead, the second phase is executed first. Therefore, the output order of the protected memory trace for a piece of encrypted data is not identical to the output order of sensitive variables in the corresponding computational phase in the theoretical encryption calculation. Furthermore, the number of bytes in the actual memory trace differs from the theoretical number of bytes generated in the corresponding computational phase.

[0098] In addition, it should be noted that the usual attack model does not simulate the complete encryption process, but only simulates the Figure 4 The first of the computational phases of the encryption process of the white-box encryption system in the unprotected theoretical state shown is simulated. This first phase is hereinafter referred to as the target phase. Furthermore, to determine the first degree of match, it is obvious that the prediction data and encrypted data corresponding to the same phase must be used. Therefore, the bytes in the memory trace of the data to be encrypted must be processed using concatenation parameters, filtering out the bytes corresponding to the target phase and processing them to obtain a single byte. In some implementations, the representation of the concatenation parameters can refer to the aforementioned selection parameters.

[0099] In some implementations, a single connection parameter may be used in the first simulation process, which means that the user assumes that an attacker can obtain the position correspondence between each byte in the predicted data and each byte in the memory trace through means such as side channel attacks.

[0100] However, a more common situation is that the attacker cannot determine the positional correspondence between each byte in the predicted data and each byte in the memory trace. In this case, for any candidate key, the attacker needs to use different connection parameters to process each byte in the memory trace to filter out bytes that are relevant to the predicted data. Therefore, for a piece of data to be encrypted, using multiple connection parameters (for example, m) to process each byte in the memory trace corresponding to the data to be encrypted, m actual results can be obtained, that is, m actual result sequences can be obtained (the number of actual result sequences is also the same as the number of connection parameters). Based on the m sequence matching degrees between the predicted result sequence and the m actual result sequences, a first matching degree is determined, and then based on the first matching degree, a second probability of the candidate key being evaluated as a recommended key is determined.

[0101] Obviously, not all connection parameters can be used to filter out bytes in the memory trace that are relevant to the predicted data. However, for any candidate key, as long as the sequence match between the actual result sequence determined based on any selection parameter and the predicted result sequence of the candidate key reaches the matching threshold c, the candidate key can be determined to be a recommended key.

[0102] Thus, the probability P that the correct key is evaluated as the recommended key can be determined s , and the probability P that the wrong key is evaluated as the recommended key w After introducing multiple connection parameters, the first matching degree corresponding to the correct key is determined by the sequence matching degrees corresponding to all connection parameters with screening functions, while the first matching degree corresponding to the incorrect key is determined by all sequence matching degrees. The above formulas (5) and (6) can be expressed more generally in the form of the joint distribution of each connection parameter:

[0103]

[0104] The filtering function may specifically refer to filtering out bytes in the memory trace that are relevant to the predicted data; is a set of all connection parameters with filtering function; r represents the connection parameter; m is the total number of all connection parameters. The meaning of other parameters can be found in other formulas.

[0105] It should be noted that a traversal method can be used to determine the multiple connection parameters used when processing each byte in the memory trace of the data to be encrypted. Specifically, a window length for the connection parameters is predetermined. Based on this window length, multiple windows are determined within a sequence of bytes corresponding to the complete memory trace of the data to be encrypted. For a window containing multiple consecutive bytes, the weights corresponding to each byte outside the window are set to 0. For each byte within the window, the possible weight combinations of each byte are traversed to obtain the connection parameters corresponding to the window. For example, taking a memory trace corresponding to the data to be encrypted with a total of 4 bytes as an example (of course, in reality, the memory trace corresponding to the data to be encrypted may be hundreds of bytes), the data to be encrypted is recorded as (n1, n2, n3, n4) in the order of the bytes, and the window length is set to 2. This results in three windows: (n1, n2, 0, 0), (0, n2, n3, 0), and (0, 0, n3, n4). The weights of the two bytes in each window can be 0 or 1, so four selection parameters can be determined for each window. Thus, when the memory trace has a total of 4 bytes and the window length is 2, 12 selection parameters can be determined.

[0106] On the other hand, in some implementations, the second probability that the candidate key is evaluated as the recommended key may be determined based on multiple first matching degrees respectively determined under multiple selection parameters.

[0107] In order to improve the efficiency of using memory traces, the attacker may use multiple selection parameters to process each byte in the predicted data corresponding to the data to be encrypted, determine multiple first matching degrees corresponding to each selection parameter, and then determine the second probability that the candidate key is evaluated as the recommended key based on the multiple first matching degrees.

[0108] It's important to note that using multiple selection parameters to infer the correct key requires more computation than using a single selection parameter, even with the same number of memory traces. However, fewer memory traces are required to achieve the target probability for the first probability. This means that, ignoring computational time, the attacker's ability to obtain the correct key is greater. Therefore, introducing multiple selection parameters to determine the second probability, and thus the first number, allows for a more rigorous assessment of the security of the target encryption system.

[0109] Specifically, according to the multiple first matching degrees respectively determined under the multiple selection parameters, the second probability that the candidate key is evaluated as the recommended key is determined, and a screening scheme or an accumulation scheme may be adopted.

[0110] If a screening scheme is used, the probability that the candidate key is evaluated as a recommended key under the multiple selection parameters is determined based on the multiple first matching degrees, and this is used as the second probability that the candidate key is evaluated as a recommended key. Thus, based on the aforementioned formulas (7) and (8), formulas (9) and (10) can be obtained:

[0111]

[0112] in, P can be calculated according to the above formula (7) s Determine the method; P can be calculated according to the above formula (8) w The method is determined; u represents the selection parameter; Represents the set of all selection parameters. It should be noted that It only represents the probability that a single wrong key is evaluated as the recommended key. Except for one correct key, all other keys among the candidate keys are wrong keys.

[0113] If the cumulative scheme is adopted, the probability that the candidate key is evaluated as a recommended key under at least one selection parameter is determined based on the multiple first matching degrees, and used as the second probability that the candidate key is evaluated as a recommended key. Thus, based on the above formulas (7) and (8), formulas (11) and (12) are obtained:

[0114]

[0115] The various parameters can be referred to other formulas and will not be described here in detail.

[0116] In addition, in some implementations, the sequence matching degree corresponding to the correct key depends on the correlation between the memory trace output after protection and the unprotected sensitive data under the protection method adopted by the target encryption system. The higher the correlation, the higher the expectation of the sequence matching degree.

[0117] The dependencies of this sequence matching protection method can be referred to the formulas in the previous article.

[0118] Here we provide a supplementary method for determining the correlation between the output memory trace after protection and the unprotected sensitive data. In the masking scheme, the correlation can refer to the following formula:

[0119] Cor=1-2 -d+1 (13)

[0120] Where d is the number of sub-variables connected by XOR operation in the split result of the masking scheme.

[0121] In the virtual shuffling scheme, the correlation can be referred to the following formula:

[0122]

[0123] Among them, N s The total number of generated virtual data and data to be encrypted can be recorded as n+1, referring to the introduction of the virtual shuffling method in the previous article.

[0124] In the coding scheme, the correlation is determined by the Hamming weight of the selection parameters and the connection parameters. It is difficult to determine directly, but the correlation corresponding to each selection parameter satisfies the following formula:

[0125]

[0126] Wherein, Cor is the correlation corresponding to the combination of each selection parameter and the connection parameter.

[0127] In addition, due to the differences in the correlations corresponding to the selected parameters in the coding scheme, the above formula (5) can be more rigorously expressed as:

[0128]

[0129] Here, i represents the combination of each selection parameter and connection parameter.

[0130] In addition, in Figure 3 In step S305 shown, a second number of memory traces is randomly determined until it is determined based on the first relationship that the first probability corresponding to the second number is not less than the target probability, and a binary search is used to determine, among each number below the second number, a first number whose corresponding first probability matches the target probability.

[0131] In some implementations, the reverse deduction process may include: randomly determining a second number of memory traces until determining, based on the first relationship, that a first probability corresponding to the second number is not less than the target probability, and using a binary search to determine, among each number below the second number, a first number whose corresponding first probability matches the target probability.

[0132] Specifically, in some implementations, after determining a second number that is not less than the target probability, half of the second number can be determined as a third number, and multiple rounds of binary search operations can be performed until the difference between the second number and the third number is less than a difference threshold. Figure 5 A schematic diagram of the binary search process in an embodiment of this specification is shown. max Represents the second quantity, which is also the maximum quantity, N min Represents the third quantity, which is also the smallest quantity, N midrepresents the fourth quantity, which is the average of the third quantity and the second quantity. The binary search operation in any round specifically includes: determining the fourth quantity based on the average of the second quantity and the third quantity; determining the first probability corresponding to the fourth quantity in the current round based on the first relationship; if the first probability corresponding to the fourth quantity is not less than the target probability, using the fourth quantity as the second quantity in the next round; otherwise, using the fourth quantity as the third quantity in the next round; and determining the first quantity based on at least one of the current second quantity and the third quantity.

[0133] In the 1990s, technological improvements could be clearly distinguished as either hardware improvements (for example, improvements to circuit structures like diodes, transistors, and switches) or software improvements (improvements to process flows). However, with the advancement of technology, many process flow improvements today can now be considered direct improvements to hardware circuit structures. Designers almost always create the corresponding hardware circuit structure by programming the improved process flow into the hardware circuit. Therefore, it cannot be said that a process flow improvement cannot be implemented using hardware modules. For example, a programmable logic device (PLD), such as a field programmable gate array (FPGA), is an integrated circuit whose logical function is determined by user programming. Designers can "integrate" a digital system on a PLD through their own programming, without having to hire a chip manufacturer to design and manufacture a dedicated integrated circuit chip. Moreover, nowadays, instead of manually fabricating integrated circuit chips, this programming is mostly done using "logic compiler" software. This is similar to the software compiler used when developing programs. Before compilation, the original code must also be written in a specific programming language, called a hardware description language (HDL). There is not just one HDL, but many, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art will also understand that by simply programming the method flow in one of these hardware description languages and then programming it into an integrated circuit, a hardware circuit that implements the logic method flow can be easily obtained.

[0134] The controller can be implemented in any suitable manner. For example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also know that in addition to implementing the controller in a purely computer-readable program code format, the controller can be implemented in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, such a controller can be considered a hardware component, and the devices included therein for implementing various functions can also be considered as structures within the hardware component. Or even, the devices for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0135] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a server system. Of course, this application does not exclude that with the future development of computer technology, the computer that implements the functions of the above embodiments may be, for example, a personal computer, a laptop computer, an in-vehicle human-computer interaction device, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0136] Although one or more embodiments of this specification provide method operation steps as described in the embodiments or flow charts, more or fewer operation steps may be included based on conventional or non-creative means. The order of steps listed in the embodiments is only one way of executing the order of many steps and does not represent the only execution order. When the device or terminal product in practice is executed, it can be executed in sequence or in parallel according to the method shown in the embodiments or the drawings (for example, a parallel processor or a multi-threaded processing environment, or even a distributed data processing environment). The term "comprise", "include" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, product or equipment including a series of elements includes not only those elements, but also includes other elements that are not clearly listed, or also includes elements inherent to such process, method, product or equipment. In the absence of more restrictions, it is not excluded that there are other identical or equivalent elements in the process, method, product or equipment including the elements. For example, if the words first, second, etc. are used to represent the name, they do not represent any particular order.

[0137] For the convenience of description, the above devices are described in terms of functions divided into various modules. Of course, when implementing one or more of the present specifications, the functions of each module can be implemented in the same or multiple software and / or hardware, or the module that implements the same function can be implemented by a combination of multiple sub-modules or sub-units, etc. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0138] The present invention is described with reference to flowcharts and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0139] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0140] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0141] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0142] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0143] Computer-readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic disk storage, graphene storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory media such as modulated data signals and carrier waves.

[0144] Those skilled in the art will appreciate that one or more embodiments of this specification may be provided as a method, system, or computer program product. Thus, one or more embodiments of this specification may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0145] One or more embodiments of this specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, and the like that perform specific tasks or implement specific abstract data types. One or more embodiments of this specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communications network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0146] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between the various embodiments can be referenced across them. Each embodiment focuses on the differences from the other embodiments. In particular, since the system embodiments are generally similar to the method embodiments, their description is relatively simple. For relevant parts, reference can be made to the description of the method embodiments. Throughout this specification, reference to the terms "one embodiment," "some embodiments," "examples," "specific examples," or "some examples" means that the specific features, structures, materials, or characteristics described in conjunction with that embodiment or example are included in at least one embodiment or example of this specification. In this specification, the schematic representations of these terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples. Furthermore, those skilled in the art may combine and integrate the different embodiments or examples, and features of different embodiments or examples, described in this specification, without conflict.

[0147] The foregoing description is merely an example of one or more embodiments of this specification and is not intended to limit the one or more embodiments of this specification. Those skilled in the art will appreciate that various modifications and variations of one or more embodiments of this specification are possible. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of this specification are intended to be included within the scope of the claims.

Claims

1. A method for evaluating key security for white-box encryption, the method comprising: determining, based on a first simulation process of inferring a key from memory traces in a target attack mode, a first relationship between a first probability of inferring a correct key and a number of memory traces, wherein the memory traces are a data set of intermediate states generated during an encryption process of the target encryption system; According to the first relationship, reverse deduction is performed to obtain a first number of memory traces that makes the first probability meet the target probability; The security of the target encryption system is evaluated based on the first quantity.

2. The method according to claim 1, wherein Determining a first relationship between a first probability of guessing a correct key and the number of memory traces includes: Determining multiple candidate keys; For any candidate key, use the candidate key to process a plurality of data to be encrypted to generate prediction data, determine a first degree of match between the prediction data and a current number of memory traces corresponding to the plurality of data to be encrypted; and determine a second probability that the candidate key is evaluated as a recommended key based on the first degree of match; The first probability is determined according to the second probability corresponding to each candidate key, thereby obtaining the first relationship.

3. The method according to claim 2, wherein: For any data to be encrypted, corresponding predicted data includes a plurality of bytes; determining a first degree of match between the predicted data and a current number of memory traces corresponding to the plurality of data to be encrypted includes: For any data to be encrypted, each byte in the predicted data corresponding to the data to be encrypted is processed using the preset selection parameters to obtain the predicted result corresponding to the data to be encrypted; each byte in the memory trace corresponding to the data to be encrypted is processed using the preset connection parameters to obtain the actual result corresponding to the data to be encrypted; Determine a sequence matching degree between a prediction result sequence formed by the prediction results of each of the plurality of data to be encrypted and an actual result sequence formed by the actual results, and determine the first matching degree based on the sequence matching degree.

4. The method according to claim 3, wherein: Determining, based on the first matching degree, a second probability that the candidate key is evaluated as a recommended key, specifically includes: A second probability that the candidate key is evaluated as a recommended key is determined based on the multiple first matching degrees respectively determined under the multiple selection parameters.

5. The method of claim 4 , wherein determining the second probability that the candidate key is evaluated as the recommended key based on the multiple first matching degrees determined under the multiple selection parameters comprises: Determining, based on the multiple first matching degrees, a probability that the candidate key is evaluated as a recommended key under the multiple selection parameters as a second probability that the candidate key is evaluated as a recommended key; or According to the multiple first matching degrees, a probability that the candidate key is evaluated as a recommended key under at least one selection parameter is determined as a second probability that the candidate key is evaluated as a recommended key.

6. The method according to claim 3, wherein: Determining the first matching degree according to the sequence matching degree specifically includes: The first matching degree is determined according to multiple sequence matching degrees determined under multiple connection parameters.

7. The method of claim 2, wherein: The degree of sequence matching corresponding to the correct key depends on the correlation between the protected output memory trace and the unprotected sensitive data under the protection method adopted by the target encryption system. The higher the correlation, the higher the expected degree of sequence matching.

8. The method of claim 1, wherein, based on the first relationship, inversely calculating a first number of memory traces for which the first probability satisfies a target probability comprises: According to the first relationship, the first number of memory traces that makes the second probability corresponding to the correct key meet the target probability and the second probability corresponding to the incorrect key meet the preset attack deviation probability is obtained by reverse deduction.

9. The method of claim 1, wherein, based on the first relationship, inversely calculating a first number of memory traces for making the first probability meet a first target probability comprises: randomly determining a second number of memory traces until a first probability corresponding to the second number is determined to be not less than the target probability according to the first relationship; By using a binary search, a first quantity whose corresponding first probability matches the target probability is determined among the quantities below the second quantity.

10. The method of claim 1, wherein: Evaluating the security of the target encryption system according to the first quantity includes: The key life cycle of the target encryption system is determined according to the first number; the longer the key life cycle is, the higher the security of the target encryption system is.

11. A computing device comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method according to any one of claims 1 to 10 is implemented.

Images