White box encryption method and computing device

Abstract

A white-box encryption method and a computing device, the method comprising: acquiring a first number of data to be encrypted including at least one piece of real data and a plurality of confused data, randomly and correspondingly inputting the first number of data to be encrypted into a first number of computing modules, each calculation module processes the input to-be-encrypted data by using the same target white box encryption program deployed in the calculation module; wherein the first number is determined according to an improvement proportion of a target key life cycle expected to be reached by a user relative to an original key life cycle of a target white box encryption program, and according to an output result of the calculation module of the first number, an encryption result for real data is determined, according to the method, the key life cycle of the target white-box encryption program can be prolonged on the premise that an internal algorithm of the target white-box encryption program is not changed, so that the target white-box encryption program can use the same key to complete encryption of more data, and the overhead caused by operations such as frequent key negotiation and lookup table updating in a use scene is reduced.

Description

Technical Field

[0001] The embodiments of this specification belong to the field of data processing technology, and more particularly, to a white-box encryption method and computing device. Background Art

[0002] In actual industrial applications, commonly used, highly efficient white-box solutions, such as the CEJO (Chow-Eisen-Johnson-Oorschot) scheme, which relies on table lookup implementations, often suffer from low security. For example, with the most commonly used table lookup-based code protection scheme in industry, the key typically needs to be replaced after a few hundred encryptions to prevent attackers from obtaining the correct key through memory traces leaked during the encryption process. To ensure that the white-box key cannot be obtained by attackers, frequent key negotiation and lookup table updates constitute a significant computational overhead.

[0003] Currently, researchers are mostly focused on studying newer encryption algorithms. However, it is difficult to propose effective transformation plans for existing target white-box encryption programs.

[0004] Therefore, it is expected that there will be a white-box encryption scheme to improve the key security of the target white-box encryption program. Summary of the Invention

[0005] The present invention aims to provide a white box encryption method and computing device, comprising:

[0006] A first aspect of the present disclosure provides a white-box encryption method, the method comprising:

[0007] Obtaining a first amount of data to be encrypted, which includes at least one real data and a plurality of obfuscated data;

[0008] Randomly inputting the first amount of data to be encrypted into a first number of computing modules, so that each computing module processes the input data to be encrypted using the same target white-box encryption program deployed therein; wherein the first amount is determined based on a ratio of a target key lifecycle desired by a user relative to an original key lifecycle of the target white-box encryption program;

[0009] An encryption result for the real data is determined according to output results of the first number of computing modules.

[0010] In some implementations, the square of the first number is proportional to the boost ratio.

[0011] In some implementations, the method further includes determining the first quantity based on the improvement ratio and a first relationship, wherein the first relationship represents the relationship between the memory traces required for an attacker to obtain the current key of the target white-box encryption program and the quantity of the computing modules, and the memory traces are a data set of intermediate states generated during the encryption process of the target white-box encryption program.

[0012] In some implementations, the first relationship is determined according to the following steps:

[0013] determining, based on a simulation process of inferring a key from memory traces in a target attack mode, a second relationship between a first probability of inferring a correct key and a number of memory traces, wherein the number of memory traces depends on the number of computing modules used in the encryption process;

[0014] The first relationship is determined according to the second relationship.

[0015] In some implementations, determining a second relationship between a first probability of inferring a correct key and a number of memory traces includes:

[0016] Determining multiple candidate keys;

[0017] For any candidate key, using the candidate key to process a plurality of data to be encrypted to generate prediction data, determining a first degree of match between the prediction data and a current number of memory traces corresponding to the plurality of data to be encrypted, the first degree of match being dependent on the number of computing modules used in the encryption process; and determining a second probability that the candidate key is evaluated as a recommended key based on the first degree of match.

[0018] The first probability is determined according to the second probability corresponding to each candidate key, thereby obtaining the second relationship.

[0019] In some implementations, determining the first relationship based on the second relationship specifically includes:

[0020] According to the second relationship, a first relationship between the number of memory traces and the number of computing modules used in the encryption process is determined under the condition that the first probability meets the target probability, and the target probability is set by the user and indicates the user's maximum acceptable probability.

[0021] In some implementations, an output result of the computing module that receives the obfuscated data is independent of the target white-box encryption program.

[0022] In some implementations, for any computing module that receives obfuscated data, an output result corresponding to the computing module is determined according to a first masking scheme; an output result corresponding to a computing module that receives real data is determined according to the white-box encryption algorithm and the first masking scheme;

[0023] Determining an encryption result for the real data based on output results of the multiple computing modules specifically includes:

[0024] According to the first masking scheme, output results of the multiple computing modules are processed to determine an encryption result for the real data.

[0025] In some implementations, the method further includes:

[0026] Determine, according to the first masking scheme, a plurality of first masks corresponding to the plurality of computing modules respectively, wherein an exclusive OR combination result of the plurality of first masks is 0;

[0027] Wherein, for any computing module that receives obfuscated data, the output result corresponding to the computing module is the first mask corresponding to the computing module; the output result corresponding to the computing module that receives real data is determined based on the first mask corresponding to the computing module and the encryption result of the target white-box encryption program;

[0028] Determining an encryption result for the real data based on output results of the multiple computing modules specifically includes:

[0029] An encryption result for the real data is determined according to a combination result of the XOR combination of the output results of the multiple calculation modules.

[0030] A second aspect of this specification provides a computing device, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method described in the first aspect is implemented.

[0031] The white-box encryption scheme provided in the embodiments of this specification can improve the key life cycle of the target white-box encryption program without changing the internal algorithm of the target white-box encryption program, so that the target white-box encryption program can use the same key to encrypt more data, thereby reducing the computational overhead caused by frequent key negotiation and lookup table updates in usage scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the technical solutions of the embodiments of this specification, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0033] Figure 1 This is a schematic diagram of a technical concept for improving the key life cycle of a target white-box encryption program in an embodiment of this specification;

[0034] Figure 2 This is a flowchart of a white box encryption method in an embodiment of this specification;

[0035] Figure 3 This is a schematic diagram of the corresponding relationship when different batches of data to be encrypted are input into the calculation module in an embodiment of this specification;

[0036] Figure 4 It is a schematic diagram of the relationship between the encryption result and the output result in one embodiment of this specification. DETAILED DESCRIPTION

[0037] To help those skilled in the art better understand the technical solutions in this specification, the following will provide a clear and complete description of the technical solutions in the embodiments of this specification, in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of this specification, not all of them. All other embodiments derived by those skilled in the art based on the embodiments in this specification without creative effort shall fall within the scope of protection of this specification.

[0038] The following will first explain the professional terms that may be involved in this manual.

[0039] In white-box cryptography, a white-box attack scenario is assumed, where an attacker can obtain not only the input and output of the encryption algorithm but also the intermediate data used in the encryption process. Furthermore, they have the ability to track the executed code and feed data to the algorithm an unlimited number of times to guess the key. The attacker's goal is to obtain the key used by the encryption algorithm, and the corresponding encryption algorithm should ensure that the key cannot be obtained by the attacker. To address such white-box attack scenarios, current research focuses on improving encryption algorithms to increase their resistance to attacks and reduce the probability of obtaining the key through attacks. A typical evaluation criterion for white-box algorithms is whether they can guarantee that the encryption algorithm cannot be cracked in such an attack scenario.

[0040] However, because white-box cryptography assumes an attacker with virtually unlimited power, capable of performing arbitrary operations on the software programs that implement the cryptographic algorithms, cryptographic algorithms that can defend against such attackers have yet to be fully implemented. In practice, deployed white-box cryptographic programs typically only offer protection against certain types of attacks. Consequently, deployed white-box cryptographic programs are often configured with a set rekeying period to limit attackers' vulnerability by limiting the amount of time the key can be exposed.

[0041] The problem with this is that the key update time is usually set based on a real-world time system, which is an empirical defense setting. Users cannot objectively and quantitatively evaluate the security of the target white-box encryption program (under the existing evaluation system, all target white-box encryption programs are insecure), and thus cannot improve the target white-box encryption program with the goal of improving security. It should be noted that, due to the limitations of actual application scenarios, the improvements referred to here are improvements made to the target white-box encryption program without changing its internal algorithm.

[0042] Therefore, based on the application requirements of real-world scenarios, this embodiment first proposes a weak white-box attack model—the memory trace attack model—and proposes a key security evaluation criterion under this memory trace attack model: the key lifecycle. Furthermore, based on the key lifecycle, this embodiment introduces a white-box protection method that can improve the key lifecycle of the target white-box encryption program.

[0043] For the sake of clarity, the following will first explain the professional terms that may be involved in this manual.

[0044] Memory trace: A memory trace is the collection of all intermediate states generated during the execution of a software program. In the field of encryption, a memory trace can be the sub-output of each intermediate step in the encryption algorithm.

[0045] Memory trace attack model: In normal operational practice, it is always possible to protect the encryption software program to a certain extent through some known means to avoid the formation of a pure white box attack environment. Therefore, the protection of encryption programs in a weak white box environment is more practical. The memory trace attack model is an abstract model for attackers in a weak white box environment proposed in this specification. The memory trace attack model has the following characteristics: (1) The attacker can only obtain memory trace information and the corresponding plaintext and ciphertext, and the target white box encryption program does not leak other information; (2) The attacker can only collect memory traces through the normal execution of the encryption process; (3) The plaintext (ciphertext) used in encryption (decryption) is not selected by the attacker and is considered to be a random value that obeys a uniform distribution from the attacker's perspective; (4) There is no strict limit on the attack time complexity. The memory trace attack model is established based on the application requirements in actual scenarios. Compared with the traditional white box attack model (the attacker can not only obtain memory trace information, but also reverse encode the target white box encryption program to obtain the implementation statement of the encryption process), it is more in line with the capabilities of attackers in actual scenarios.

[0046] Anti-reverse engineering: Reverse engineering is a technical means of dissecting and analyzing a product to obtain information such as its design principles, technical parameters, and manufacturing processes. In the field of white-box encryption, reverse engineering can be used by attackers to obtain the running permissions and internal code of the target white-box encryption program. Anti-reverse engineering is a technical means to counter reverse engineering, which can be specifically divided into hardware and software levels. Among them, technical means at the hardware level may include encryption chip technology, physical uncloning technology, anti-tampering sensor technology, etc.; technical means at the software level may include code obfuscation technology, digital signature and authentication technology, configuration file encryption technology, etc. For the target white-box encryption program that has undergone certain anti-reverse engineering processing, the attacker may conform to the aforementioned memory trace attack model.

[0047] Protection Scheme: Unlike reverse engineering, the goal of implementing a protection scheme is to prevent attackers from directly accessing sensitive variables within the target white-box encryption program. Without a protection scheme, the memory traces captured by the attacker are equivalent to sensitive variables, allowing the attacker to directly retrieve the correct key from the memory traces. Common protection schemes include encoding, masking, and virtual shuffling.

[0048] Sensitive variables: Real variables generated during the execution of an unprotected cryptographic algorithm. In the target white-box encryption program, sensitive variables are not actually generated due to the existence of the protection scheme.

[0049] The key life cycle, proposed in this specification, refers to the number of encrypted data that can be encrypted using the same key in a white box encryption system while meeting security requirements.

[0050] Figure 1 This diagram illustrates a technical concept for improving the key lifecycle of a target white-box encryption program in one embodiment of this specification. It should be noted that the target white-box encryption program may refer to an encryption program that has been processed by at least one of the aforementioned protection schemes, i.e., the memory trace of the target white-box encryption program is not equal to the sensitive variable.

[0051] In this embodiment, the encryption process after the key life cycle of the target white-box encryption program is increased will be first introduced, and then how to determine the first quantity will be introduced based on the encryption process.

[0052] like Figure 1 As shown, the number of computing modules in the white box encryption system is recorded as N s In this embodiment, N s =4, and the target white box encryption program is deployed in each computing module. When using the white box encryption system to encrypt real data, the first step is the data generation stage. In the data generation stage, (Ns -1) obfuscated data, each obfuscated data and real data are used as data to be encrypted, wherein the data dimensions and formats of the obfuscated data and the real data are the same. The data generation stage can be executed by the white box encryption system or by other computing devices, and this specification does not limit this. Subsequently, it is the data input stage. In the data input stage, the four data to be encrypted are randomly input into the four computing modules. Next, it is the encryption calculation stage, which is divided into two sub-stages. In the first sub-stage, each computing module will use the target white box encryption program to process its own data to be encrypted and determine the encryption result for its own data to be encrypted. In the second sub-stage, after obtaining the encryption result, each computing module needs to perform masking scheme processing to determine the output result of each computing module. Among them, in the second sub-stage, for any computing module, the computing module can know whether its own data to be encrypted is real data. Therefore, different masking methods can be used according to the type of data to be encrypted (real data or obfuscated data) input to itself. Finally, it is the result restoration stage. In the result restoration stage, the white box encryption system can perform masking scheme processing according to the N s The output results of each calculation module are used to determine the encryption result of the real data according to the decoding processing method corresponding to the mask scheme.

[0053] From the encryption process and the definition of the memory trace described above, we can conclude that during the data generation phase, an attacker can only obtain all the data to be encrypted, but cannot determine which specific data is the real data. During the data input phase, since each data to be encrypted is randomly assigned to a computing module, that is, the computing module used to encrypt the real data input can be different for each encryption, making it impossible for an attacker to determine the computing module corresponding to the real data. During the encryption calculation phase, each computing module normally encrypts the data to be encrypted using the target white-box encryption program, and the resulting memory traces have the same data format and data dimensions. Similarly, an attacker cannot distinguish between the output results and memory traces of each computing module. Throughout the entire encryption process, an attacker cannot determine the correspondence between the real data and the computing module.

[0054] It can be noted that the total amount of memory traces obtained by the attacker during each stage of encryption using the white-box encryption system is almost the same as that obtained when only one target white-box encryption program is used for encryption. s However, since the attacker cannot determine the correspondence between the real data and the computing module, the extra information is obfuscated information (memory traces generated during the obfuscated data encryption process) that the attacker cannot use. The ratio of obfuscated information to real information is also roughly the same as N when only one target white box encryption program is used. sFor example, when only real information is used to obtain the current key of the target white-box encryption program, 10% of the nodes in all memory traces (here, one bit of data can be understood as a node in the memory trace) are related to the predictable computing state (because the target white-box encryption program has been protected by the protection scheme, the memory trace and the current key are usually not completely related. In addition, the memory trace related to the predictable computing state can also be regarded as related to the current key used for encryption). After using the white-box encryption system and setting N s = 4, only about 2.5% of all memory trace nodes are correlated with predictable computational states. Hereinafter, the proportion of data in the memory trace that is relevant to the current key is referred to as correlation. According to the method for determining key lifetime, this reduction in correlation will correspondingly increase the key lifetime, meaning that the white-box cryptosystem increases the amount of data that can be encrypted using the same key (the method for determining key lifetime will be detailed in the following sections).

[0055] By reversely deducing the relationship between the key life cycle and the correlation, the improvement ratio can be calculated based on the user's expectations. The number of computational models used in the white-box encryption system—a first number—is determined.

[0056] Specifically, the target key life cycle L that the user expects to achieve can be determined e The improvement ratio of the original key life cycle L relative to the target white box encryption program Then, the first quantity is determined according to the improvement ratio.

[0057] In some implementations, the first number N may be determined based on the improvement ratio that the user expects to achieve. s You can refer to the following formula:

[0058]

[0059] Wherein, ρ is a loss parameter, which can be derived based on the key lifecycle determination method. In some implementations, ρ can be set to 0.5. As can be seen from formula (1), the square of the first quantity is proportional to the improvement ratio. Furthermore, the process of determining the improvement ratio can be performed by the user directly setting the desired improvement ratio without the need to pre-evaluate the original key lifecycle of the target white-box encryption program.

[0060] Figure 2 A schematic flow chart of a white-box encryption method in an embodiment of this specification is shown. The white-box encryption method can be executed using a white-box encryption system. The white-box encryption system can be deployed on a computing device with computing capabilities. The method includes:

[0061] Step S201: Obtain a first amount of data to be encrypted, which includes at least one real data and a plurality of obfuscated data.

[0062] The real data is the data that the user actually needs to encrypt, and the obfuscated data is interference information introduced to prevent attackers from obtaining the key through the encryption process.

[0063] The multiple obfuscated data may be pre-generated by the white box encryption system or other computing devices before executing step S201, and this specification does not impose any limitation thereto.

[0064] It should be noted that this specification does not limit the encryption algorithm used by the target white-box encryption program. The encryption algorithm may be, for example, an encryption algorithm such as the Advanced Encryption Standard (AES) and the Triple DES (3DES). For example, when AES encryption is used, the corresponding encryption parameters may include a lookup table LUT embedded with key information, such as a T table, a Ty table, etc. In some embodiments, the above encryption algorithm may also be a white-box encryption algorithm that has undergone certain white-box protection based on a standard encryption algorithm, such as the white-box AES algorithm proposed by Chow et al. This specification does not specifically limit the encryption algorithm used in this link. On the other hand, this specification also does not specifically limit the protection method used by the target white-box encryption program.

[0065] Step S203: Randomly input the first amount of data to be encrypted into a first number of computing modules, so that each computing module processes the input data to be encrypted using the same target white-box encryption program deployed therein; wherein the first amount is determined based on the improvement ratio of the target key life cycle expected by the user relative to the original key life cycle of the target white-box encryption program.

[0066] It should be noted that before executing step S201, the white box encryption system may determine the first quantity based on the improvement ratio of the target key life cycle expected by the user relative to the original key life cycle of the target white box encryption program. Figure 2 The method shown in the figure requires calling each computing module, deploying the same target white box encryption program to the first number of computing modules. After the target white box encryption program is deployed, there is no difference between the computing modules in theory.

[0067] After executing step S201 to obtain each piece of data to be encrypted, the white box encryption system may randomly input a first number of pieces of data to be encrypted into a first number of computing modules. Figure 3The corresponding relationship when different batches of data to be encrypted are input into the computing module is shown. It can be seen that in step S203, the real data will be equally likely to appear in any computing module. In addition, the position relationship between the real data and the obfuscated data is also randomly determined. Therefore, an attacker cannot determine the location of the real data during this process.

[0068] On the other hand, when using the target white-box encryption program to process the input data to be encrypted, each computing module has the same processing flow, and the attacker cannot determine the location of the real data based on the processing flow of the target white-box encryption program.

[0069] It should be noted that in step S203, for each computing module, the computing module uses its own deployed target white-box encryption program to determine the encryption result of its input data to be encrypted. However, after obtaining the encryption result of its own data to be encrypted, the computing module must further process the encryption result according to the masking scheme to obtain the output result of the computing module.

[0070] As mentioned above, the specific masking methods used to encrypt real data and obfuscated data are different. However, as long as the input-output format of each masking method is the same, the masking methods will still be indistinguishable from the attacker's perspective.

[0071] Step S205: Determine an encryption result for the real data according to the output results of the first number of computing modules.

[0072] After obtaining the output results of the first number of computing modules, the white-box encryption system can combine the output results according to the adopted masking scheme to determine the encryption result for the real data.

[0073] In some implementations, an output result of the computing module that receives the obfuscated data is independent of the target white-box encryption program.

[0074] Furthermore, for any computing module that receives obfuscated data, the output result corresponding to the computing module is determined according to the first masking scheme; the output result corresponding to the computing module that receives real data is determined according to the white box encryption algorithm and the first masking scheme; Figure 2 In step S205 shown, the output results of the multiple calculation modules are processed according to the first masking scheme to determine the encryption result for the real data.

[0075] Figure 4 FIG1 shows a schematic diagram of the relationship between the encryption result and the output result in one embodiment of this specification. Figure 4As shown, on the one hand, the output results of the computing module that receives the obfuscated data are independent of the target white-box encryption program, thereby ensuring that most of the output results obtained by the attacker are useless obfuscated data. On the other hand, the white-box encryption system uses the output results of all computing modules to determine the encryption results for the real data, ensuring that the attacker cannot restore the encryption results of the real data based on part of the output results, that is, the attacker must consume more computing power and time to process all the output results, further demonstrating the security of the white-box encryption system.

[0076] Specifically, the white box encryption system can pre-generate mask data corresponding to each computing module according to the first mask scheme, so that the combination result of each mask data according to the combination method in the first mask scheme is 0, and then randomly distribute the mask data to each computing module. Figure 2 In step S203 shown in FIG, the calculation module receiving the obfuscated data directly sets the mask data as the masked output result, while the calculation module receiving the real data determines the output result according to the encryption result and the mask data; Figure 2 In step S205 shown, the white-box encryption system combines the output results according to the combination method in the first mask method to obtain an encryption result for the real data.

[0077] A specific implementation of the first masking method is given below. Figure 2 Before step S203 shown, the white-box encryption system determines, according to the first masking scheme, a plurality of first masks corresponding to the plurality of computing modules, respectively, and the result of the XOR combination of the plurality of first masks is 0:

[0078]

[0079] in, Represents each first mask, Indicates XOR operation. After the first mask is XORed and combined, the result is 0.

[0080] In the execution of Figure 2 After step S205, for any computing module that receives obfuscated data, the output result corresponding to the computing module is the first mask corresponding to the computing module; the output result corresponding to the computing module that receives real data is determined based on the first mask corresponding to the computing module and the encryption result of the target white-box encryption program, for example, the XOR result of the first mask and the encryption result:

[0081]

[0082]

[0083] Among them, i represents the number of each computing module, m represents the number of the computing module that receives the real data, and c i Represents the output results of each calculation module, s i Indicates the encryption results of each calculation module.

[0084] Finally, if Figure 2 In step S205 shown, the encryption result for the real data is determined according to the combination result of the XOR combination of the output results of the multiple calculation modules.

[0085] like Figure 2 The white-box encryption method shown can improve the key lifecycle of the target white-box encryption program without changing the internal algorithm of the target white-box encryption program, so that the target white-box encryption program can use the same key to encrypt more data, reducing the computational overhead caused by frequent key negotiation and lookup table updates in the usage scenario.

[0086] Additionally, in some implementations, the white-box encryption system may be implemented by executing Figure 2 Before step S201 shown, the first quantity is determined based on the improvement ratio and the first relationship, wherein the first relationship represents the relationship between the memory traces required for an attacker to obtain the current key of the target white-box encryption program and the quantity of the computing modules, and the memory traces are a data set of intermediate states generated during the encryption process of the target white-box encryption program.

[0087] Based on known attack patterns, attackers typically use several candidate keys to process the encrypted data, simulating the memory trace generation process and obtaining the predicted data generated during the process. Furthermore, by matching the memory trace with the predicted data, they select a recommended key from the candidate keys as a guess at the correct key.

[0088] Specifically, the attack mode adopted by the attacker may be, for example, differential computation analysis (DCA), white-box learning parity with noise (WBLPN) and other common attack modes, which are not limited in this specification.

[0089] On the other hand, the multiple computing modules in the white-box encryption system can also be considered as an additional protection scheme for the target white-box encryption program. Therefore, based on the aforementioned attack model, the relationship between the number of memory traces and computing modules required for an attacker to obtain the current key of the target white-box encryption program under the additional protection scheme can be determined—a first relationship. Based on this first relationship and the improvement ratio, a first quantity that meets user requirements can be determined.

[0090] Specifically, in some implementations, the second relationship between the first probability of inferring the correct key and the number of memory traces can be determined based on a simulation process of inferring the key from the memory traces in a target attack mode, where the number of memory traces depends on the number of computing modules used in the encryption process; and the first relationship is determined based on the second relationship.

[0091] Continuing from the above introduction to the attack mode, the first probability depends on the second probabilities of each candidate key being evaluated as a recommended key, wherein the candidate keys include correct keys and incorrect keys. For any candidate key, the second probability corresponding to the candidate key depends on the first matching degree of the candidate key, where the first matching degree is the matching degree between the predicted data generated by processing the data to be encrypted using the candidate key and the memory trace corresponding to the data to be encrypted.

[0092] Specifically, in some implementations, the attacker's attack process includes: determining multiple candidate keys, for any candidate key, using the candidate key to process multiple data to be encrypted to generate predicted data, determining a first matching degree between the predicted data and the current number of memory traces corresponding to the multiple data to be encrypted, the first matching degree depends on the number of computing modules used in the encryption process; based on the first matching degree, determining a second probability that the candidate key is evaluated as a recommended key, and determining the first probability based on the second probabilities corresponding to each candidate key, thereby obtaining the first relationship.

[0093] If the memory trace corresponding to the same data to be encrypted matches the predicted data, the data to be encrypted is considered to have passed the match, and the first matching degree may be the number of data to be encrypted that have passed the match.

[0094] Here is an expression of the second relation:

[0095]

[0096] In formula (4), the second probability that the correct key is evaluated as the recommended key is recorded as P s , the second probability that the wrong key is evaluated as the recommended key is recorded as P w . Among them, N(·) represents the probability density function of the normal distribution; Φ(·) represents the probability distribution function of the normal distribution; N t is the number of memory traces; c is the difference threshold; T w With T r is the first degree of match; Cor is the correlation (which can be understood as the correlation between the predicted data and the memory trace, or as the proportion of data in the memory trace that is related to the current key actually used by the target white-box encryption program. The two are essentially the same. The correlation is determined by the protection scheme of the white-box encryption system and depends on the number of computing modules used in the encryption process, which will be explained in detail below).

[0097] It should be noted that the number of memory traces can be represented by the number of data to be encrypted corresponding to the memory traces. Therefore, under the premise of a given target probability, N t This is the key life cycle.

[0098] Furthermore, in some implementations, a first relationship between the number of memory traces and the number of computing modules used in the encryption process can be determined based on formula (4) under the condition that the first probability meets the target probability, and the target probability is set by the user and indicates the user's maximum acceptable probability.

[0099] It should be noted that since the correlation is determined by the protection scheme of the white-box encryption system, which is represented by the number of computing modules used in the encryption process, the first relationship can be determined by determining the relationship between the correlation and the key life cycle.

[0100] Wherein, the target probability may include the expected P s Value (can be set by the user, indicating the expected recommendation probability of the correct key, P s The larger the value, the greater the probability that the attacker can obtain the correct key. s The larger the value, the higher the user's security requirements) and P w The value (can be set by the user) indicates the expected recommendation probability of the wrong key. The larger the value, the more wrong keys are recommended to the attacker. When too many wrong keys are recommended, even if the correct key is recommended, the attacker still cannot accurately obtain the correct key. Therefore, the attacker will w The value is restricted to avoid all candidate keys being recommended).

[0101] According to the above formula, the more direct first relationship can be derived as follows:

[0102]

[0103] Among them, Φ -1 (·) represents the inverse function of the probability density function of the normal distribution. Other parameters can refer to the previous formula.

[0104] According to this formula, it can be determined that the key lifetime and the square of the correlation show an approximately inverse relationship. On the other hand, the correlation and the number of computing modules also show an approximately inverse relationship. This feature is determined by Figure 1 It can be derived from the example in . It should be noted that the original correlation of the target white-box encryption program can be regarded as the correlation when only one computing module is used. Furthermore, when only one computing module is used, the key life cycle determined according to formula (5) is the original key life cycle of the target white-box encryption program.

[0105] Thus, it can be approximately determined that the improvement ratio of the target key life cycle that the user expects to achieve relative to the original key life cycle of the target white-box encryption program is proportional to the square of the first quantity.

[0106] Then, the loss parameter is set based on experience, and the aforementioned formula (1) is determined as a universal formula for determining the first quantity.

[0107] Therefore, this specification proposes a method for quantitatively improving the key life cycle of the target white-box encryption program while maintaining security, and proposes an efficient transformation plan for transforming the white-box encryption program currently used in actual scenarios.

[0108] In the 1990s, technological improvements could be clearly distinguished as either hardware improvements (for example, improvements to circuit structures like diodes, transistors, and switches) or software improvements (improvements to process flows). However, with the advancement of technology, many process flow improvements today can now be considered direct improvements to hardware circuit structures. Designers almost always create the corresponding hardware circuit structure by programming the improved process flow into the hardware circuit. Therefore, it cannot be said that a process flow improvement cannot be implemented using hardware modules. For example, a programmable logic device (PLD), such as a field programmable gate array (FPGA), is an integrated circuit whose logical function is determined by user programming. Designers can "integrate" a digital system on a PLD through their own programming, without having to hire a chip manufacturer to design and manufacture a dedicated integrated circuit chip. Moreover, nowadays, instead of manually fabricating integrated circuit chips, this programming is mostly done using "logic compiler" software. This is similar to the software compiler used when developing programs. Before compilation, the original code must also be written in a specific programming language, called a hardware description language (HDL). There is not just one HDL, but many, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art will also understand that by simply programming the method flow in one of these hardware description languages ​​and then programming it into an integrated circuit, a hardware circuit that implements the logic method flow can be easily obtained.

[0109] The controller can be implemented in any suitable manner. For example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also know that in addition to implementing the controller in a purely computer-readable program code format, the controller can be implemented in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, such a controller can be considered a hardware component, and the devices included therein for implementing various functions can also be considered as structures within the hardware component. Or even, the devices for implementing various functions can be considered as both software modules that implement the method and structures within the hardware component.

[0110] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a server system. Of course, this application does not exclude that with the future development of computer technology, the computer that implements the functions of the above embodiments may be, for example, a personal computer, a laptop computer, an in-vehicle human-computer interaction device, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0111] Although one or more embodiments of this specification provide method operation steps as described in the embodiments or flow charts, more or fewer operation steps may be included based on conventional or non-creative means. The order of steps listed in the embodiments is only one way of executing the order of many steps and does not represent the only execution order. When the device or terminal product in practice is executed, it can be executed in sequence or in parallel according to the method shown in the embodiments or the drawings (for example, a parallel processor or a multi-threaded processing environment, or even a distributed data processing environment). The term "comprise", "include" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, product or equipment including a series of elements includes not only those elements, but also includes other elements that are not clearly listed, or also includes elements inherent to such process, method, product or equipment. In the absence of more restrictions, it is not excluded that there are other identical or equivalent elements in the process, method, product or equipment including the elements. For example, if the words first, second, etc. are used to represent the name, they do not represent any particular order.

[0112] For the convenience of description, the above devices are described in terms of functions divided into various modules. Of course, when implementing one or more of the present specifications, the functions of each module can be implemented in the same or multiple software and / or hardware, or the module that implements the same function can be implemented by a combination of multiple sub-modules or sub-units, etc. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0113] The present invention is described with reference to flowcharts and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0114] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0115] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0116] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0117] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0118] Computer-readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic disk storage, graphene storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory media such as modulated data signals and carrier waves.

[0119] Those skilled in the art will appreciate that one or more embodiments of this specification may be provided as a method, system, or computer program product. Thus, one or more embodiments of this specification may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0120] One or more embodiments of this specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, and the like that perform specific tasks or implement specific abstract data types. One or more embodiments of this specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communications network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0121] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between the various embodiments can be referenced across them. Each embodiment focuses on the differences from the other embodiments. In particular, since the system embodiments are generally similar to the method embodiments, their description is relatively simple. For relevant parts, reference can be made to the description of the method embodiments. Throughout this specification, reference to the terms "one embodiment," "some embodiments," "examples," "specific examples," or "some examples" means that the specific features, structures, materials, or characteristics described in conjunction with that embodiment or example are included in at least one embodiment or example of this specification. In this specification, the schematic representations of these terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples. Furthermore, those skilled in the art may combine and integrate the different embodiments or examples, and features of different embodiments or examples, described in this specification, without conflict.

[0122] The foregoing description is merely an example of one or more embodiments of this specification and is not intended to limit the one or more embodiments of this specification. Those skilled in the art will appreciate that various modifications and variations of one or more embodiments of this specification are possible. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of this specification are intended to be included within the scope of the claims.

Claims

1. A white-box encryption method, comprising: Obtaining a first amount of data to be encrypted, which includes at least one real data and a plurality of obfuscated data; Randomly inputting the first amount of data to be encrypted into a first number of computing modules, so that each computing module processes the input data to be encrypted using the same target white-box encryption program deployed therein; wherein the first amount is determined based on a ratio of a target key lifecycle desired by a user relative to an original key lifecycle of the target white-box encryption program; An encryption result for the real data is determined according to output results of the first number of computing modules.

2. The method according to claim 1, wherein The square of the first number is proportional to the improvement ratio.

3. The method according to claim 1, further comprising determining the first quantity according to the promotion ratio and the first relationship, wherein: The first relationship represents the relationship between the memory traces required by an attacker to obtain the current key of the target white-box encryption program and the number of the computing modules, and the memory traces are a data set of intermediate states generated during the encryption process of the target white-box encryption program.

4. The method according to claim 3, wherein: The first relationship is determined according to the following steps: determining, based on a simulation process of inferring a key from memory traces in a target attack mode, a second relationship between a first probability of inferring a correct key and a number of memory traces, wherein the number of memory traces depends on the number of computing modules used in the encryption process; The first relationship is determined based on the second relationship.

5. The method according to claim 4, wherein: Determining a second relationship between a first probability of guessing a correct key and the number of memory traces includes: Determining multiple candidate keys; For any candidate key, using the candidate key to process a plurality of data to be encrypted to generate prediction data, determining a first degree of match between the prediction data and a current number of memory traces corresponding to the plurality of data to be encrypted, the first degree of match being dependent on the number of computing modules used in the encryption process; and determining a second probability that the candidate key is evaluated as a recommended key based on the first degree of match. The first probability is determined according to the second probability corresponding to each candidate key, thereby obtaining the second relationship.

6. The method according to claim 4, wherein determining the first relationship according to the second relationship comprises: According to the second relationship, a first relationship between the number of memory traces and the number of computing modules used in the encryption process is determined under the condition that the first probability meets the target probability, and the target probability is set by the user and indicates the user's maximum acceptable probability.

7. The method of claim 1, wherein: The output result of the computing module receiving the obfuscated data is independent of the target white-box encryption program.

8. The method of claim 7, wherein: For any computing module that receives obfuscated data, the output result corresponding to the computing module is determined according to the first masking scheme; the output result corresponding to the computing module that receives real data is determined according to the white-box encryption algorithm and the first masking scheme; Determining an encryption result for the real data based on output results of the multiple computing modules specifically includes: According to the first masking scheme, output results of the multiple computing modules are processed to determine an encryption result for the real data.

9. The method of claim 8, further comprising: Determine, according to the first masking scheme, a plurality of first masks corresponding to the plurality of computing modules respectively, wherein an exclusive OR combination result of the plurality of first masks is 0; Wherein, for any computing module that receives obfuscated data, the output result corresponding to the computing module is the first mask corresponding to the computing module; the output result corresponding to the computing module that receives real data is determined based on the first mask corresponding to the computing module and the encryption result of the target white-box encryption program; Determining an encryption result for the real data based on output results of the multiple computing modules specifically includes: An encryption result for the real data is determined according to a combination result of the XOR combination of the output results of the multiple calculation modules.

10. A computing device comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method according to any one of claims 1 to 9 is implemented.

Images