White box encryption system and white box encryption method

Abstract

The white box encryption system comprises an encryption module and an updating module, the encryption module is subjected to reverse engineering resisting processing, the encryption module is used for responding to an encryption request of a user and encrypting target data through a current secret key, and the updating module is used for determining the number of memory traces generated in the encryption process and updating the number of the memory traces generated in the encryption process. When the cumulative number of memory traces generated by using the current key exceeds a predetermined key life cycle, the current key is updated, and the memory traces are a data set in an intermediate state generated in the operation process of the encryption module; the key life cycle is determined according to the number of the memory traces required by the attacker to obtain the current key, the key life cycle is determined by simulating the attack behavior of the attacker to obtain the key, the key protection method targeted to the memory trace attack is provided, and compared with a traditional key protection method, the key protection method has the advantages that the key protection efficiency is improved. The updating frequency of the secret key can be dynamically controlled according to the use intensity of the secret key, and an efficient and safe secret key protection scheme is provided.

Description

Technical Field

[0001] The embodiments of this specification belong to the field of data processing technology, and in particular to a white-box encryption system and a white-box encryption method. Background Art

[0002] With the rise and application of cryptography in business, encryption algorithms are inevitably applied in insecure real-world environments. In typical hypothetical environments, attackers can only obtain the input and output of encryption algorithms. However, in real-world scenarios such as mobile payments, the Internet of Things, and mobile applications, the terminal devices executing encryption algorithms can be under the attacker's control. This allows attackers to obtain not only the input and output of the encryption algorithms, but also the memory traces and executed code during the encryption process. This type of environment is also known as a white-box attack environment.

[0003] In a white-box attack environment, attackers can launch more frequent and precise attacks on encryption algorithms, which poses a greater security challenge to the keys in encryption algorithms.

[0004] Therefore, it is expected that there will be an encryption protection solution to deal with unsafe environments where attacks may occur. Summary of the Invention

[0005] The present invention aims to provide a white box encryption system and a white box encryption method, comprising:

[0006] A first aspect of this specification provides a white box encryption system, the system comprising an encryption module and an update module, the encryption module being processed to resist reverse engineering;

[0007] The encryption module is used to encrypt the target data using the current key in response to the user's encryption request;

[0008] The update module is used to determine the number of memory traces generated during the encryption process, and update the current key when the cumulative number of memory traces generated using the current key exceeds a predetermined key life cycle, wherein the memory trace is a data set of intermediate states generated during the operation of the encryption module; the key life cycle is determined based on the number of memory traces required for an attacker to obtain the current key.

[0009] A second aspect of this specification provides a white-box encryption method, which is applied to a white-box encryption system. The white-box encryption system includes an encryption module and an update module. The encryption module is processed to resist reverse engineering. The method includes:

[0010] utilizing the encryption module to encrypt target data using the current key in response to a user's encryption request;

[0011] The update module is used to determine the number of memory traces generated during the encryption process. When the cumulative number of memory traces generated using the current key exceeds a preset key life cycle, the current key is updated, wherein the memory trace is a data set of intermediate states generated during the operation of the encryption module; the key life cycle is determined based on the number of memory traces required for an attacker to obtain the current key.

[0012] A third aspect of this specification provides a computing device, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method described in the second aspect is implemented.

[0013] The white-box encryption technology solution provided in this embodiment determines the key life cycle by simulating the attacker's attack behavior to obtain the key, and then monitors the number of memory traces generated during the encryption process and updates the key according to the number of memory traces. It proposes a key protection method targeted at memory trace attacks. Compared with traditional key protection methods, such as timed key updates, it can dynamically control the key update frequency according to the intensity of key usage, providing an efficient and secure key protection solution. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] In order to more clearly illustrate the technical solutions of the embodiments of this specification, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0015] Figure 1 This is a schematic diagram of the technical concept of the white box encryption solution in an embodiment of this specification;

[0016] Figure 2 This is a schematic diagram of the structure of a white box encryption system in an embodiment of this specification;

[0017] Figure 3 This is a schematic diagram of the binary search process in an embodiment of this specification;

[0018] Figure 4 This is a flowchart illustrating a white box encryption method in one embodiment of this specification. DETAILED DESCRIPTION

[0019] To help those skilled in the art better understand the technical solutions in this specification, the following will provide a clear and complete description of the technical solutions in the embodiments of this specification, in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of this specification, not all of them. All other embodiments derived by those skilled in the art based on the embodiments in this specification without creative effort shall fall within the scope of protection of this specification.

[0020] As mentioned earlier, to adapt to insecure encryption environments, researchers have proposed the concept and algorithms of white-box cryptography. In white-box cryptography, the concept assumes the existence of a white-box attack environment, where an attacker can obtain not only the input and output of the encryption algorithm but also the intermediate data during the encryption process. Furthermore, the attacker has the ability to track the executed code and feed data an unlimited number of times to guess the key. To address such white-box attack environments, current research focuses on improving encryption algorithms to enhance their resilience and reduce the probability of obtaining the key through attacks. However, in practice, it is always difficult to propose a convincing and ideal white-box cryptographic algorithm that ensures the secure implementation of the encryption process under white-box attack environments.

[0021] After research, the inventors discovered that a major cause of this dilemma is that white-box cryptography assumes an attacker with virtually unlimited power, capable of performing arbitrary operations on the software programs that implement the cryptographic algorithms. However, the inventors observed that this characteristic does not hold true in normal industrial use. In typical operational practices, encryption software programs can always be protected to a certain degree through known means, avoiding the creation of a pure white-box attack environment. Therefore, research on the protection of encryption programs in weak white-box environments is of greater practical significance.

[0022] To this end, the inventors proposed a weak white-box attack model - the memory trace attack model, and studied the protection of encrypted programs under this attack model. In this specification, corresponding solutions are given through embodiments.

[0023] For the sake of clarity, the following will first explain the professional terms that may be involved in this specification.

[0024] Memory trace: A collection of data representing the intermediate states generated during the execution of a software program. In the context of encryption, a memory trace can be the intermediate states of each intermediate step in an encryption algorithm. It should be noted that in a white-box cryptographic system, each intermediate step is processed by a protection scheme. The memory trace differs from the actual state generated during the execution of a standard cryptographic algorithm without such protection schemes. Therefore, an attacker cannot directly and accurately determine the encryption parameters used in the white-box cryptographic system based on the memory trace.

[0025] Anti-reverse engineering: Reverse engineering is a technical means of dissecting and analyzing a product to obtain information such as its design principles, technical parameters, and manufacturing processes. In the field of white-box encryption, reverse engineering can be used by attackers to obtain the operating permissions and internal code of the white-box encryption system. Anti-reverse engineering is a technical means to counter reverse engineering, which can be specifically divided into hardware and software levels. Among them, technical means at the hardware level may include encryption chip technology, physical uncloning technology, anti-tampering sensor technology, etc.; technical means at the software level may include code obfuscation technology, digital signature and authentication technology, configuration file encryption technology, etc.

[0026] Memory trace attack model: First of all, it should be noted that for white-box encryption systems, the attacker's attack goal is to obtain the correct key. For example, in the IoT scenario, after obtaining the correct key, the attacker can use the correct key to disguise the terminal device and send false messages to the IoT system. The memory trace attack model is an abstract model of the attacker's attack method proposed in this specification. The memory trace attack model has the following characteristics: (1) The attacker can only obtain memory trace information and the corresponding plaintext and ciphertext, and the white-box encryption system does not leak other information; (2) The attacker can only collect memory traces through the normal execution of the encryption process; (3) The plaintext (ciphertext) used in encryption (decryption) is not selected by the attacker and is considered to be a random value that obeys a uniform distribution from the attacker's perspective; (4) There is no strict limit on the time complexity of the attack.

[0027] It should be noted that the memory trace attack model proposed above, which limits the attacker's attack capabilities, is more consistent with the capabilities of attackers in actual scenarios. In actual application scenarios, the attacker's attack capabilities are usually limited by the white box encryption system's protection measures - anti-reverse engineering. For example, through at least one of code obfuscation technology, encryption chip, physical cloning technology, and configuration file encryption technology, the attacker can be prevented from obtaining the internal code of the white box encryption system, thereby realizing the feature (1) of the above memory trace attack model; through anti-tampering sensor technology, digital signature and authentication technology, the device binding or application binding function of the white box encryption system can be realized, so that the attacker cannot obtain the use rights of the white box encryption system on his own, thereby realizing the features (2) and (3) of the above memory trace attack model. For the white box encryption system that has adopted the above anti-reverse engineering treatment, the attacker's attack capabilities are consistent with the above memory trace attack model.

[0028] According to existing attack models, an attacker typically uses several candidate keys to process the encrypted data, simulating the memory trace generation process and obtaining the predicted data generated during the processing. Furthermore, by comparing the memory traces with the predicted data, a recommended key is selected from the candidate keys, which serves as a guess for the correct key. This attack model shows that the greater the number of memory traces, the more information the attacker can rely on when comparing the memory traces with the predicted data, and thus the greater the probability of selecting the recommended key from the candidate keys.

[0029] Therefore, from the perspective of a white-box cryptosystem, the security of a key decreases the more information is encrypted using that key. On the other hand, in the aforementioned memory trace attack model, other factors that interfere with key security are eliminated, and thus the key lifecycle explicitly depends on the number of memory traces generated during the encryption process using that key. Therefore, in this embodiment, the key security of the white-box cryptosystem can be assessed based on the number of memory traces required for an attacker to obtain the current key, thereby determining the key lifecycle in the white-box cryptosystem.

[0030] Figure 1 The schematic diagram of the technical concept of the white box encryption scheme in an embodiment of this specification is shown. The white box encryption scheme is based on the aforementioned memory trace attack model, that is, the white box encryption system has been processed to resist reverse engineering. Take the complete encryption process of a piece of data to be encrypted as an example, Figure 1 As shown, the encryption module uses the current key and corresponding encryption parameters to perform multiple rounds of processing on the encrypted data, ultimately obtaining an encrypted result. This multiple round processing can, for example, be 10 rounds of processing using the white-box AES algorithm. During this process, an attacker cannot obtain the encryption parameters and current key within the encryption module. They can only obtain the memory traces generated during the encryption process, the encrypted data, and the encryption result.

[0031] In this scenario, an attacker can only use memory traces to attempt to obtain the correct key (i.e., the current key in use in the white-box cryptosystem). Under the condition that the attacker can only use memory traces to attempt to obtain the correct key, the attacker's attack pattern can be predicted by the white-box cryptosystem. Furthermore, based on the attacker's likely attack pattern, the white-box cryptosystem can predict the number of memory traces required for the attacker to obtain the current key, further determining the key lifecycle.

[0032] Of course, in actual usage scenarios, encryption modules often need to encrypt multiple pieces of data, either continuously or intermittently. Therefore, the update module can monitor the encryption module's encryption process and, if the cumulative number of memory traces generated by the current key exceeds a predetermined key lifetime, update the current key used by the encryption module. Therefore, to obtain the updated current key, an attacker must collect memory traces again. The white-box encryption system cyclically executes the aforementioned key update process, ensuring that an attacker cannot successfully obtain the current key.

[0033] In the traditional field of white-box encryption, attackers are usually assumed to have complete attack capabilities - they can obtain the internal code of the white-box encryption system through reverse engineering, and even obtain the operating permissions of the white-box encryption system. Under such assumptions, the security of the white-box encryption system is difficult to be clearly measured. Accordingly, existing research has also focused on how to improve the encryption algorithm used by the white-box encryption system to systematically solve security problems. Based on actual application needs, this embodiment applies anti-reverse engineering to the white-box encryption system, further summarizes the aforementioned memory trace attack model, and thus proposes a white-box encryption system that monitors the number of memory traces and updates the key according to the number of memory traces. It can adapt to the capabilities of attackers in actual scenarios, provide security protection for the keys used in the white-box encryption system, and propose a feasible solution to the security problems of the white-box encryption system.

[0034] In some implementations, the attack mode used by the aforementioned attacker may be, for example, differential computation analysis (DCA) and white-box learning parity with noise (WBLPN).

[0035] Figure 2 The white-box encryption system of one embodiment of this specification is shown as a schematic diagram. The white-box encryption system may include an encryption module and an update module. The encryption module is processed to resist reverse engineering. The white-box encryption system can be deployed on a computing device with computing capabilities.

[0036] The encryption module 201 is used to encrypt target data using the current key in response to a user's encryption request.

[0037] Specifically, the encryption process may include acquiring target data, encrypting the target data using a current key and encryption parameters corresponding to the current key, and determining an encryption result.

[0038] Here is an additional description of the memory trace, such as Figure 1As shown, the encryption process in the encryption module can be understood as a function operation process. Generally, the encryption process can be composed of multiple sub-functions. Figure 1 Each sub-function in the encryption module processes memory traces using the current key and encryption parameters. Due to anti-reverse engineering measures, the connections between sub-functions in the encryption module are not exposed. However, since the inputs and outputs of each sub-function inevitably appear in device memory during the encryption process, these inputs and outputs can be obtained by attackers as memory traces.

[0039] It should also be noted that the encryption module may be processed by digital signature and authentication technology, so that the encryption module only responds to encryption requests from users with authenticated identities and encrypts authenticated target data.

[0040] Specifically, this specification does not limit the encryption algorithm used by the encryption module to encrypt the target data using the current key. The encryption algorithm may be, for example, an encryption algorithm such as the Advanced Encryption Standard (AES) or the Triple DES (3DES). For example, when AES encryption is used, the corresponding encryption parameters may include a lookup table LUT embedded with key information, such as a T table, a Ty table, etc. In some embodiments, the above encryption algorithm may also be a white-box encryption algorithm that has undergone certain white-box protection based on a standard encryption algorithm, such as the white-box AES algorithm proposed by Chow et al. This specification does not specifically limit the encryption algorithm used in this link.

[0041] The update module 203 is used to determine the number of memory traces generated during the encryption process, and to update the current key when the cumulative number of memory traces generated using the current key exceeds a predetermined key life cycle, wherein the memory trace is a data set of intermediate states generated during the operation of the encryption module; the key life cycle is determined based on the number of memory traces required for an attacker to obtain the current key.

[0042] The update module can monitor the encryption module and determine the number of memory traces generated by the encryption module during the encryption process using the current key. When the cumulative number of memory traces generated using the current key exceeds the predetermined key life cycle, the current key is updated.

[0043] In some implementations, the update module can determine the number of memory traces generated by the encryption module using the current key by monitoring the number of encryption results, without having to monitor the entire encryption process. This can reduce the monitoring overhead of the update module.

[0044] It should be noted that in order to determine the memory traces required by the attacker to obtain the current key, the aforementioned attack modes can be reversely deduced, which will not be elaborated in this manual.

[0045] Furthermore, due to the key update mechanism, the current key is always replaced after a certain number of memory traces have been generated during encryption. Therefore, even if an attacker manages to obtain the current key's state with a very small probability, the update module prevents the attacker from exploiting it without restriction. This not only protects the current key from being obtained by an attacker, but also reduces the risk of key acquisition at the overall system level.

[0046] In some implementations, the update module may send an update instruction to the encryption module so that the encryption module automatically updates the current key and uses the updated key to encrypt subsequent target data; or the updated key may be sent to the encryption module so that the encryption module uses the updated key to encrypt subsequent target data. This specification does not impose any restrictions here.

[0047] In other implementations, the encryption parameters used to encrypt the target data may depend on the current key. Therefore, when the update module updates the current key, it also needs to synchronously update the encryption parameters in the encryption module according to the updated key.

[0048] like Figure 2 The white-box encryption system shown in the figure simulates the attacker's attack behavior to obtain the key, determines the key lifecycle, and then monitors the number of memory traces generated during the encryption process. It updates the key based on the number of memory traces. Compared with traditional key protection methods, such as periodic key updates, this can dynamically control the key update frequency according to the intensity of key usage, providing an efficient and secure key protection scheme.

[0049] In some implementations, the key lifecycle is determined based on a minimum memory trace requirement, which is the minimum number of memory traces required for an attacker to achieve a preset target probability of success in obtaining the current key under multiple attack modes.

[0050] It should be noted that the target probability can be set by the user, indicating the user's maximum acceptable probability, that is, the maximum value of the probability that the current key is obtained by an attacker that is acceptable to the user of the white-box encryption system.

[0051] Typically, the target probability can be set to any value greater than 0. The smaller the target probability, the higher the user's requirement for key security, and the smaller the number of memory traces corresponding to the key lifetime. However, since there is no absolutely secure cryptographic system, the target probability cannot be set to 0. In other words, there is no key lifetime that satisfies the target probability of 0.

[0052] As mentioned above, the more memory traces an attacker obtains, the greater the probability that the current key will be cracked. Therefore, determining the key lifetime based on the minimum number of required memory traces can ensure the security of the current key under the strictest conditions.

[0053] To further ensure the security of the current key in the white box encryption system and provide redundancy for the system, the key life cycle can be determined by multiplying the minimum memory trace requirement by a preset redundancy ratio, where the redundancy ratio is less than 1.

[0054] In some of the following implementations, the system further comprises or is connected to a life cycle determination module 205 , which includes a quantity determination submodule 205A and a period calculation submodule 205B;

[0055] The quantity determination submodule 205A is configured to determine a first quantity of memory traces required for achieving a preset target probability of success in acquiring the current key in the first attack mode.

[0056] Among them, the first attack mode can be any known attack mode, such as the differential calculation analysis, white box learning parity check, etc. mentioned above, which will not be described in detail in this specification.

[0057] The attack processes of feasible attack modes have certain commonalities. As mentioned above, the attack process can be summarized as "using several candidate keys to process the encrypted data, simulating the generation process of memory traces, and obtaining the predicted data generated during the processing. Furthermore, by comparing the memory traces with the predicted data, the recommended key is selected from the candidate keys."

[0058] According to this attack process, the quantity determination submodule can be used to determine the first simulation process of inferring the key from the memory traces in the first attack mode, and based on the first simulation process, evaluate the first relationship between the first probability of obtaining the correct key and the number of memory traces, and based on the first relationship, reversely infer the first number of memory traces that meets the target probability.

[0059] The first relationship may be an abstract representation of the first simulation process. Specifically, the first relationship may be represented as a functional relationship between memory traces and the first probability, so that the first number of memory traces that meets the target probability can be obtained by reverse deduction through the functional relationship.

[0060] Specifically, the first probability depends on the second probabilities of each candidate key being evaluated as a recommended key, wherein the candidate keys include correct keys and incorrect keys. For any candidate key, the second probability corresponding to the candidate key depends on the test matching degree of the candidate key, and the test matching degree is the matching degree between the predicted data generated by processing the data to be encrypted using the candidate key and the memory trace corresponding to the data to be encrypted.

[0061] The following is an implementation method for reverse deducing the first number of memory traces that meet the target probability based on the first relationship. First of all, it should be noted that due to the existence of the protection scheme in the white-box encryption system, even if the attacker uses the correct key to encrypt the data to be encrypted, there will be differences between the predicted data and the memory traces generated during the encryption process of the white-box encryption system. If the wrong key is used for encryption, the predicted data is completely unrelated to the memory trace, and the probability that each output node in the predicted data has the same value as the corresponding output node in the memory trace is 0.5 (each independent output node in the memory trace can be represented as a 0,1 variable, and the corresponding output node in the predicted data can also be represented as a 0,1 variable. Under completely random conditions, the probability of two 0,1 variables being the same is 0.5), that is, according to expectations, half of the output nodes of the predicted data have the same value as the corresponding output nodes in the memory trace. However, if the correct key is used for encryption, and there is a certain correlation between the memory trace and the predicted data (the value of the correlation between the memory trace and the predicted data varies depending on the type of protection scheme), then the probability that each output node in the predicted data has the same value as the corresponding output node in the memory trace will be significantly different from 0.5. That is, as expected, the number of output nodes for which the predicted data has the same value as the corresponding output node in the memory trace will significantly deviate from half.

[0062] Thus, in some implementations, the test match can be expressed as the number of output nodes in the predicted data that are identical to the corresponding output nodes in the memory trace. The second probability function is a probability function with the test match as the independent variable. To distinguish, the second probability corresponding to the correct key is denoted as P s , the second probability that the wrong key is evaluated as the recommended key is recorded as

[0063]

[0064] Where N(·) represents the probability density function of the normal distribution; Φ(·) represents the probability distribution function of the normal distribution; N t is the number of memory traces; c is the difference threshold; T w With T r is the test matching degree; Cor is the correlation between the predicted data and the memory trace, which is determined by the protection scheme of the white box encryption system. sThe value (that is, the target probability) and P w The value (can be set by the user) indicates the expected recommendation probability of the wrong key. The larger the value, the more wrong keys are recommended to the attacker. When too many wrong keys are recommended, even if the correct key is recommended, the attacker still cannot accurately obtain the correct key. Therefore, the attacker will w Under the condition that the values are restricted to avoid all candidate keys being recommended), the only unknowns in the two formulas are c and N t , the first number N can be determined from this t .

[0065] In other implementations, a simulated attack experiment can be conducted based on the first simulation process, attempting to obtain the correct key based on a certain number of memory traces. The first relationship is determined by counting the number of successes and failures, and then the first number of memory traces required to meet the target probability is inferred.

[0066] In some implementations, the reverse deduction process may include: randomly determining a second number of memory traces until determining, based on the first relationship, that a first probability corresponding to the second number is not less than the target probability, and using a binary search to determine, among each number below the second number, a first number whose corresponding first probability matches the target probability.

[0067] Specifically, in some implementations, after determining a second number that is not less than the target probability, half of the second number can be determined as a third number, and multiple rounds of binary search operations can be performed until the difference between the second number and the third number is less than a difference threshold. Figure 3 A schematic diagram of the binary search process in an embodiment of this specification is shown. max Represents the second quantity, which is also the maximum quantity, N min Represents the third quantity, which is also the smallest quantity, N mid represents the fourth quantity, which is the average of the third quantity and the second quantity. The binary search operation in any round specifically includes: determining the fourth quantity based on the average of the second quantity and the third quantity; determining the first probability corresponding to the fourth quantity in the current round based on the first relationship; if the first probability corresponding to the fourth quantity is not less than the target probability, using the fourth quantity as the second quantity in the next round; otherwise, using the fourth quantity as the third quantity in the next round; and determining the first quantity based on at least one of the current second quantity and the third quantity.

[0068] The period calculation submodule 205B is configured to calculate the key life cycle at least based on the first quantity.

[0069] In some implementations, the quantity determination submodule can be used to treat each known attack mode as a first attack mode and determine the first quantity corresponding to each first attack mode; further, the period calculation submodule can be used to calculate the key life cycle based on the minimum value of each first quantity.

[0070] The minimum value among the first quantities may be directly determined as the key lifetime, or the minimum value among the first quantities may be multiplied by a preset redundancy ratio to determine the key lifetime. This specification does not impose any limitation on this.

[0071] Since the key life cycle is obtained by strictly inverting the first relationship, the key life cycle does not need to be blindly set to a higher value to meet the security requirements of user key protection and can efficiently protect the current key.

[0072] Figure 4 A flowchart of a white-box encryption method in an embodiment of this specification is shown. The method is applied to a white-box encryption system. The white-box encryption system includes an encryption module and an update module. The encryption module has been processed to resist reverse engineering. The method includes:

[0073] Step S401: utilizing the encryption module to encrypt target data using the current key in response to a user's encryption request.

[0074] For the specific encryption process, please refer to the introduction of the encryption module in the previous article, which will not be repeated here.

[0075] Step S403: Using the update module, determine the number of memory traces generated during the encryption process. When the cumulative number of memory traces generated using the current key exceeds a preset key life cycle, update the current key, wherein the memory trace is a data set of intermediate states generated during the operation of the encryption module; the key life cycle is determined based on the number of memory traces required for an attacker to obtain the current key.

[0076] For the specific update process, please refer to the introduction of the update module in the previous article, which will not be repeated here.

[0077] It should be noted that the step numbers herein do not limit the execution order of step S403 and step S401. In practical applications, the white-box encryption system may execute step S401 in a loop and may also execute step S403 to monitor the usage of the current key in the white-box encryption system.

[0078] In some implementations, the key life cycle is determined based on a minimum memory trace requirement, where the minimum memory trace requirement is the minimum value of multiple memory traces required for an attacker to achieve a preset target probability of success in obtaining the current key under multiple attack modes.

[0079] Furthermore, the target probability is set by the user and indicates the user's maximum acceptable probability.

[0080] On the other hand, the key life cycle is determined by multiplying the minimum memory trace requirement by a preset redundancy ratio, and the redundancy ratio is less than 1.

[0081] In some implementations, the system further includes or is connected to a life cycle determination module, which includes a quantity determination submodule and a period calculation submodule; the method further includes:

[0082] Step S400A, using the number of determination submodule, determines the first number of memory traces required to obtain the success rate of the current key in the first attack mode to reach a preset target probability.

[0083] Step S400B: Utilize the period calculation submodule to calculate the key life cycle at least according to the first quantity.

[0084] Therefore, before the white box encryption system executes step S401 and encrypts any target data, the key life cycle based on which the update module updates the current key can be determined in advance.

[0085] Furthermore, in step S400A, according to the first simulation process of inferring the key from the memory traces in the first attack mode, the first relationship between the first probability of obtaining the correct key and the number of memory traces is evaluated, and based on the first relationship, the first number of memory traces that meets the target probability is reversely deduced.

[0086] Among them, the first relationship shows that the first probability depends on the second probabilities of each candidate key being evaluated as a recommended key, and the candidate keys include correct keys and incorrect keys; for any candidate key, the second probability corresponding to the candidate key depends on the test matching degree of the candidate key, and the test matching degree is the matching degree between the predicted data generated by using the candidate key to process the data to be encrypted and the memory trace corresponding to the data to be encrypted.

[0087] On the other hand, in some implementations, in step S400B, a second number of memory traces is randomly determined until it is determined based on the first relationship that the first probability corresponding to the second number is not less than the target probability, and a binary search is used to determine, among each number below the second number, a first number whose corresponding first probability matches the target probability.

[0088] In some implementations, in step S401, the encryption module is used to encrypt the target data using the current key and the encryption parameters corresponding to the current key; in step S403, the update module is used to update the current key and the encryption parameters.

[0089] In the 1990s, technological improvements could be clearly distinguished as either hardware improvements (for example, improvements to circuit structures like diodes, transistors, and switches) or software improvements (improvements to process flows). However, with the advancement of technology, many process flow improvements today can now be considered direct improvements to hardware circuit structures. Designers almost always create the corresponding hardware circuit structure by programming the improved process flow into the hardware circuit. Therefore, it cannot be said that a process flow improvement cannot be implemented using hardware modules. For example, a programmable logic device (PLD), such as a field programmable gate array (FPGA), is an integrated circuit whose logical function is determined by user programming. Designers can "integrate" a digital system on a PLD through their own programming, without having to hire a chip manufacturer to design and manufacture a dedicated integrated circuit chip. Moreover, nowadays, instead of manually fabricating integrated circuit chips, this programming is mostly done using "logic compiler" software. This is similar to the software compiler used when developing programs. Before compilation, the original code must also be written in a specific programming language, called a hardware description language (HDL). There is not just one HDL, but many, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art will also understand that by simply programming the method flow in one of these hardware description languages and then programming it into an integrated circuit, a hardware circuit that implements the logic method flow can be easily obtained.

[0090] The controller can be implemented in any suitable manner. For example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also know that in addition to implementing the controller in a purely computer-readable program code format, the controller can be implemented in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, such a controller can be considered a hardware component, and the devices included therein for implementing various functions can also be considered as structures within the hardware component. Or even, the devices for implementing various functions can be considered as both software modules that implement the method and structures within the hardware component.

[0091] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a server system. Of course, this application does not exclude that with the future development of computer technology, the computer that implements the functions of the above embodiments may be, for example, a personal computer, a laptop computer, an in-vehicle human-computer interaction device, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0092] Although one or more embodiments of this specification provide method operation steps as described in the embodiments or flow charts, more or fewer operation steps may be included based on conventional or non-creative means. The order of steps listed in the embodiments is only one way of executing the order of many steps and does not represent the only execution order. When the device or terminal product in practice is executed, it can be executed in sequence or in parallel according to the method shown in the embodiments or the drawings (for example, a parallel processor or a multi-threaded processing environment, or even a distributed data processing environment). The term "comprise", "include" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, product or equipment including a series of elements includes not only those elements, but also includes other elements that are not clearly listed, or also includes elements inherent to such process, method, product or equipment. In the absence of more restrictions, it is not excluded that there are other identical or equivalent elements in the process, method, product or equipment including the elements. For example, if the words first, second, etc. are used to represent the name, they do not represent any particular order.

[0093] For the convenience of description, the above devices are described in terms of functions divided into various modules. Of course, when implementing one or more of the present specifications, the functions of each module can be implemented in the same or multiple software and / or hardware, or the module that implements the same function can be implemented by a combination of multiple sub-modules or sub-units, etc. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0094] The present invention is described with reference to flowcharts and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0095] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0096] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 The steps for the function specified in one or more boxes.

[0097] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0098] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0099] Computer-readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic disk storage, graphene storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory media such as modulated data signals and carrier waves.

[0100] Those skilled in the art will appreciate that one or more embodiments of this specification may be provided as a method, system, or computer program product. Thus, one or more embodiments of this specification may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0101] One or more embodiments of this specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, and the like that perform specific tasks or implement specific abstract data types. One or more embodiments of this specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communications network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0102] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between the various embodiments can be referenced across them. Each embodiment focuses on the differences from the other embodiments. In particular, since the system embodiments are generally similar to the method embodiments, their description is relatively simple. For relevant parts, reference can be made to the description of the method embodiments. Throughout this specification, reference to the terms "one embodiment," "some embodiments," "examples," "specific examples," or "some examples" means that the specific features, structures, materials, or characteristics described in conjunction with that embodiment or example are included in at least one embodiment or example of this specification. In this specification, the schematic representations of these terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples. Furthermore, those skilled in the art may combine and integrate the different embodiments or examples, and features of different embodiments or examples, described in this specification, without conflict.

[0103] The foregoing description is merely an example of one or more embodiments of this specification and is not intended to limit the one or more embodiments of this specification. Those skilled in the art will appreciate that various modifications and variations of one or more embodiments of this specification are possible. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of this specification are intended to be included within the scope of the claims.

Claims

1. A white-box encryption system, comprising an encryption module and an update module, wherein the encryption module is processed to resist reverse engineering; The encryption module is used to encrypt the target data using the current key in response to the user's encryption request; The update module is used to determine the number of memory traces generated during the encryption process, and when the cumulative number of memory traces generated using the current key exceeds a predetermined key life cycle, update the current key, wherein, The memory trace is a data set of intermediate states generated during the operation of the encryption module; the key life cycle is determined according to the number of memory traces required by an attacker to obtain the current key.

2. The system of claim 1, wherein: The key life cycle is determined according to a minimum memory trace requirement, which is the minimum value of a plurality of memory traces required for an attacker to achieve a preset target probability of success in obtaining the current key under a plurality of attack modes.

3. The system of claim 2, wherein: The target probability is set by the user and indicates the user's maximum acceptable probability.

4. The system of claim 2, wherein: The key life cycle is determined by multiplying the minimum memory trace requirement by a preset redundancy ratio, where the redundancy ratio is less than 1.

5. The system of claim 1, further comprising or connected to a life cycle determination module, which includes a quantity determination submodule and a cycle calculation submodule; The quantity determination submodule is used to determine a first quantity of memory traces required for achieving a preset target probability of success rate in obtaining the current key in the first attack mode, The period calculation submodule is used to calculate the key life cycle based on at least the first number.

6. The system of claim 5, wherein: The quantity determination submodule is specifically used for: Evaluate a first relationship between a first probability of obtaining a correct key and the number of memory traces according to a first simulation process of inferring a key from memory traces in a first attack mode; According to the first relationship, a first number of memory traces that meets the target probability is obtained by reverse deduction.

7. The system of claim 6, wherein: The first relationship shows that the first probability depends on the second probabilities of each candidate key being evaluated as a recommended key, and the candidate keys include correct keys and incorrect keys; for any candidate key, the second probability corresponding to the candidate key depends on the test matching degree of the candidate key, and the test matching degree is the matching degree between the predicted data generated by processing the data to be encrypted using the candidate key and the memory trace corresponding to the data to be encrypted.

8. The system of claim 6, wherein: According to the first relationship, inversely calculating to obtain a first number of memory traces that meet the target probability includes: randomly determining a second number of memory traces until a first probability corresponding to the second number is determined to be not less than the target probability according to the first relationship; By using a binary search, a first quantity whose corresponding first probability matches the target probability is determined among the quantities below the second quantity.

9. The system according to claim 1, wherein the encryption module is specifically configured to encrypt the target data using a current key and encryption parameters corresponding to the current key; The updating module is specifically used to update the current key and update the encryption parameters.

10. A white-box encryption method, the method being applied to a white-box encryption system, the white-box encryption system comprising an encryption module and an update module, the encryption module being processed to resist reverse engineering, the method comprising: utilizing the encryption module to encrypt target data using the current key in response to a user's encryption request; The update module is used to determine the number of memory traces generated during the encryption process. When the cumulative number of memory traces generated using the current key exceeds a preset key life cycle, the current key is updated, wherein the memory trace is a data set of intermediate states generated during the operation of the encryption module; the key life cycle is determined based on the number of memory traces required for an attacker to obtain the current key.

11. A computing device comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method according to claim 10 is implemented.

Images