Symmetric white box encryption method based on substitution-permutation network structure

Abstract

The invention belongs to the technical field of data encryption, and relates to a symmetric white box encryption method based on a substitution-permutation network structure. The method comprises the following steps: step 1, generating a white box assembly; step 2, encryption; and step 3, decryption. The above steps use eight algorithms, including a pre-processing matrix generation algorithm, a front external coding matrix generation algorithm, a post-processing matrix generation algorithm, a rear external coding matrix generation algorithm, a T table generation algorithm, an M matrix generation algorithm, an encryption algorithm and a decryption algorithm. According to the method, substitution and key XOR operation are converted into a pre-calculated lookup table, random secret components are introduced into the lookup table, a permutation matrix is expanded, and the structure of an encryption internal state is changed, so that an attacker is difficult to recover a key or decrypt data through a white-box attack means. Compared with an existing white-box AES scheme, the method has the advantages that compatibility with a standard decryption algorithm is kept, all existing white-box attacks can be resisted, and white-box safety is achieved.

Description

Technical Field

[0001] This invention belongs to the field of data encryption technology, specifically relating to a symmetric white-box encryption method based on a substitution-permutation network structure. Background Technology

[0002] Symmetric encryption algorithms based on substitution-permutation networks can encrypt large amounts of data in a short time, and are therefore widely used in many applications, such as database encryption, network security (e.g., SSL / TLS), disk encryption, privacy-preserving computing, the Internet of Things, cloud computing, and blockchain. However, symmetric encryption algorithms use the same key for both encryption and decryption. Once the key is leaked, the encrypted data is at risk of being decrypted and leaked. The risk of key leakage increases significantly on platforms that are not fully trusted or adequately protected. In such scenarios, adversaries have complete visibility into the implementation of the cryptographic algorithm and can completely control the execution platform; this is called a white-box scenario, and typical cases can be categorized as follows: Category 1: Exploiting unknown vulnerabilities to extract keys. Typical examples of software vulnerabilities include the SSL Heartbleed vulnerability (CVE-2014-0160) and the Log4j remote code execution vulnerability (CVE-2021-44228) disclosed in 2021. The former allows attackers to steal sensitive information such as keys from the memory of a remote host with the OpenSSL library installed; the latter enables attackers to execute arbitrary code on a server with the Apache Log4j logging library deployed, and further gain control. At the hardware level, the Meltdown vulnerability (CVE-2017-5754) affects most Intel processors that implement out-of-order execution. All of the above vulnerabilities can facilitate attackers' direct access to memory. Furthermore, if a hacker has obtained root privileges on a server or personal computer, the software modules running on the system will be completely under their control.

[0003] The second category includes applications running on potentially untrusted devices. Examples include digital rights management software running on personal computers, DVD players, and set-top boxes; virtual machines migrated to hosts controlled by attackers, which may execute malicious code to crash them; mobile agents running on malicious hosts; mobile devices captured by attackers; captured unattended wireless sensor network nodes; and roadside units and vehicle-mounted units in vehicular ad hoc networks.

[0004] The third category: Shared cache attacks in cloud computing. When different virtual machines share the same physical CPU cache, attackers can illegally read sensitive data from the victim virtual machine from their own virtual machine. Several such attacks have been discovered in recent years, such as the Spectre vulnerability (CVE-2017-5753 / 5715), the Zombieload vulnerability (CVE-2018-12130), and the Foreshadow vulnerability (CVE-2018-3615). The CacheOut vulnerability (CVE-2020-0549) can leak data from the virtual machine and its hypervisor, and can recover AES keys across virtual machines; CrossTalk (CVE-2020-0543) can, in actual attacks, exploit the communication mechanism of the Intel SGX security zone to extract the entire private key running in an independent CPU security zone.

[0005] Chow et al. first defined this untrusted execution environment as a white-box environment and proposed the first white-box cryptographic algorithm. Its core idea is to embed the key into pre-computed lookup tables and protect these tables with bijective random transformations. This design allows the encryption process to be performed without exposing the key. Several subsequent white-box cryptographic algorithms have been developed based on this framework, including introducing random perturbations into the key-containing lookup tables, using matrix multiplication to protect paired lookup tables at once, adopting equivalent AES representations to obtain more implementation variants, improving the construction of bijective random transformations, and drawing on countermeasures against differential power analysis and fault injection to enhance protection.

[0006] However, all of these schemes follow the framework proposed by Chow et al., relying on random bijective protection lookup tables. Several attacks, known as white-box attacks, exploit vulnerabilities in bijective protection to break existing white-box cryptography in a white-box environment. These include: algebraic attacks, which utilize publicly available AES computation details and the properties of bijectives to remove lookup table protection and recover the AES key; structural analysis attacks white-box cryptography with specific structures; an improved differential fault analysis attack uses algebraic techniques to remove 8 bits of external encoding and break white-box cryptography; differential computation analysis extracts the key from white-box cryptography by associating the lookup table's inputs and outputs with the key; and differential fault analysis extracts the key from white-box cryptography by injecting erroneous bytes into intermediate states. Summary of the Invention

[0007] The purpose of this invention is to overcome the shortcomings of the prior art and to improve the security of symmetric white-box encryption methods based on substitution-permutation network structures. This invention provides a symmetric white-box encryption method based on substitution-permutation network structures. By introducing random secret components into the lookup table and expanding the permutation matrix, the structure of the internal state of the encryption is effectively changed, making it difficult for attackers to recover the key or decrypt the data using existing white-box attack methods. At the same time, it ensures that the final ciphertext remains essentially unchanged, and the ciphertext can be recovered into plaintext simply by linear mapping and using standard decryption algorithms.

[0008] The technical solution of this invention is as follows: A symmetric white-box encryption method based on a substitution-permutation network structure is characterized by converting substitution and key XOR operations into a pre-computed lookup table and introducing random secret components therein, thereby expanding the permutation matrix and changing the structure of the internal state of the encryption, making it difficult for attackers to recover the key or decrypt the data through white-box attack methods. Includes the following steps: Step 1: White-box component generation; Step 2: Encrypt; Step 3: Decrypt.

[0009] Furthermore, step 1 includes: Step 1.1 Execute Algorithm 1, named This is a preprocessing matrix generation algorithm used to generate preprocessing matrices. The output is a preprocessing matrix. After execution is complete, proceed to step 1.2; Step 1.2 Execute Algorithm 2, named This is a pre-external encoding matrix generation algorithm, used to generate the pre-external encoding matrix. That is, the output is the front external encoding matrix. After execution is complete, proceed to step 1.3; Step 1.3 Execute Algorithm 3, named This is a post-processing matrix generation algorithm used to generate post-processing matrices. The output is a post-processing matrix. After execution is complete, proceed to step 1.4; Step 1.4 Execute Algorithm 4, named This is a post-external encoding matrix generation algorithm, used to generate the post-external encoding matrix. That is, the output is the post-external encoding matrix. After execution is complete, proceed to step 1.5; Step 1.5 Under the specified substitution-replacement network password parameters (enter the specified replacement box) Key parameters Execute Algorithm 5, named , is the T-table generation algorithm, used to generate the T-table, whose input is It is a pre-defined replacement box. It is a predefined key value, and the output is a table T. After execution is complete, proceed to step 1.6; Step 1.6 Execute Algorithm 6 under the specified substitution-permutation network cryptographic parameters (input the specified substitution matrix H), and name it... This is an M-matrix generation algorithm used to generate M matrices, whose input is... It is the substitution matrix specified by the substitution-permutation network cryptography algorithm. This is the preprocessing matrix generated in step 1.1. It is the pre-external encoding matrix generated in step 1.2. This is the post-processing matrix generated in step 1.3. The external encoding matrix generated in step 1.4 is output as the M matrix. After execution is complete, proceed to step 1.7; Step 1.7 Generate the pre-external encoding matrix external encoding matrix T table and M matrix Output as a white-box component.

[0010] The process of Algorithm 1 includes: S1.1 Randomly generate a size of Invertible bit matrix ; S1.2 The generated bit matrix With size identity matrix The size obtained by splicing is bit matrix ; S1.3 By means of Elementary row operations are performed to obtain the preprocessing matrix. ,in It is the first indivual Submatrix. Let , , For an 8-bit vector, the preprocessing matrix... satisfy , ; S1.4 Output Preprocessing Matrix .

[0011] The process of Algorithm 2 includes: S2.1 Randomly generate a size of Invertible bit matrix ; S2.2 Output Matrix .

[0012] The process of Algorithm 3 includes: S3.1 will have a size of identity matrix With size The zero matrix The size obtained by splicing is bit matrix ; S3.2 By... Elementary column transformations are performed to obtain the post-processing matrix. ,in It is the first indivual Submatrix. For Post-processing matrix satisfy , ; S3.3 Output Post-processing Matrix .

[0013] The process of Algorithm 4 includes: S4.1 Randomly generate a size of Invertible bit matrix ; S4.2 Output Matrix .

[0014] The process of Algorithm 5 includes: S5.1 For each round and Randomly generate a size of Invertible bit matrix Randomly generated The size is Invertible bit matrix Randomly generated A fake replacement box Randomly generated A fake key ; S5.2 For each round , and two-byte input Generate table T ; S5.3 Output T table .

[0015] The process of Algorithm 6 includes: S6.1 For round 0, generate ; S6.2 For the first First, expand the permutation matrix. for ,in It is the first indivual Submatrix. The extension method involves randomly generating two submatrices of size [missing information]. Invertible bit matrix and and the permutation matrix specified by the original algorithm The newly generated matrix and a matrix of size The zero matrix spliced ​​together to form a size of matrix ; Through the Elementary row and column transformations are performed to obtain the expanded permutation matrix. To satisfy , ; Finally, the M matrix is ​​generated. ; S6.3 For the Rth round, expand the permutation matrix using the same method as in step S6.2, and generate matrix M. ; S6.4 Output M matrix .

[0016] Furthermore, step 2 includes an encryption algorithm. Its input is table T. M matrix He Mingwen The output is in ciphertext. The encryption algorithm will start with The result after transposing the input plaintext vector Performing multiplication, we obtain a length of The result ; and then for each round and Firstly, according to The value in Intermediate results are obtained by performing a lookup operation on the table. Then all intermediate results The result is obtained by performing an XOR operation. The final matrix The result after transposition Performing multiplication yields the updated result. ; For a description of the processing procedure, please refer to Algorithm 7; Furthermore, step 3 includes a decryption algorithm. Its input is the external encoding matrix. key ciphertext The decryption algorithm first converts the external encoding matrix... The inverse matrix and the transpose of the ciphertext The result is obtained by performing multiplication. Then, the standard decryption algorithm is used. Will Decryption is performed, and finally, it is compared with the previous external encoding matrix. The final plaintext is obtained by multiplying the inverse matrix. For a description of the processing procedure, please refer to Algorithm 8; The beneficial effects of this invention are as follows: It possesses reliable security. Through anti-attack analysis and experimentation, it has proven resistant to all existing white-box attacks. It provides a white-box security design framework for all symmetric encryption algorithms based on substitution-permutation networks. It exhibits good efficiency. Efficiency experiments show that it demonstrates good encryption / decryption and white-box component generation efficiency on various experimental devices. Attached Figure Description Figure 1 This is a schematic diagram of the overall process of the present invention; Figure 2 This is a schematic diagram of a sub-process of step 1 of the present invention; Figure 3 These are the experimental results of the encryption efficiency of this invention on various experimental devices; Figure 4 These are the experimental results of the white-box component generation efficiency of this invention on various experimental devices; Figure 5 To compare the encryption efficiency of this invention with existing white-box AES-128 schemes, experimental results were conducted. Figure 6 To apply this invention to AES-128 and compare the decryption efficiency with that of standard AES-128, experimental results were presented. Detailed Implementation

[0017] The technical solution provided in this application will be further described below with reference to specific embodiments and accompanying drawings. The advantages and features of this application will become clearer from the following description.

[0018] A symmetric white-box encryption method based on a substitution-permutation network structure is proposed, comprising 3 steps and 8 algorithms.

[0019] The following section first explains the symbols and design concepts used in the invention, then introduces the white-box component generation steps, encryption steps, and decryption steps, followed by the preprocessing matrix generation algorithm, the pre-external encoding matrix generation algorithm, the postprocessing matrix generation algorithm, the post-external encoding matrix generation algorithm, the T-table generation algorithm, the M-matrix generation algorithm, the encryption algorithm, and the decryption algorithm.

[0020] The symbols used in this invention are explained in Table 1.

[0021] Table 1. Symbols used in this invention like Figure 1 As shown, the present invention includes the following steps: Step 1: As Figure 2 As shown, this step involves executing algorithms 1, 2, 3, and 4 to generate the preprocessing matrix. Pre-external encoding matrix Post-processing matrix Post-external encoding matrix And under the specified substitution-permutation network cryptographic parameters (input the specified substitution matrix) Replacement box Key parameters Execute algorithms 5 and 6 to generate the T table and M matrix, and then use the generated pre-external encoding matrix. external encoding matrix T table and M matrix Output as a white-box component.

[0022] Step 2: Execute Algorithm 7 using the generated T table and M matrix to complete encryption without exposing the key; Step 3: Utilize the generated pre-external encoding matrix and the external encoding matrix And with the specified substitution-permutation network cryptographic parameters (input the specified key parameter K), execute algorithm 8 to decrypt the ciphertext to obtain the plaintext; This concludes the steps of the entire plan.

[0023] The above process includes the following 8 algorithms: Algorithm 1: Preprocessing matrix generation algorithm The output is a preprocessing matrix. ; Algorithm 2: Pre-external encoding matrix generation algorithm, The output is the pre-external encoding matrix. ; Algorithm 3: Post-processing matrix generation algorithm The output is a post-processing matrix. ; Algorithm 4: Post-external encoding matrix generation algorithm The output is the post-external encoding matrix. ; Algorithm 5: T-table generation algorithm, Its input It is a permutation box defined by the substitution-permutation network cryptographic algorithm. It is a predefined key for the substitution-permutation network cryptography algorithm, and the output is a T-table. ; Algorithm 6: M-matrix generation algorithm Its input It is the substitution matrix specified by the substitution-permutation network cryptography algorithm. This is the preprocessing matrix generated in step 1.1. It is the pre-external encoding matrix generated in step 1.2. This is the post-processing matrix generated in step 1.3. The external encoding matrix generated in step 1.4 is output as the M matrix. ; Algorithm 7: Encryption Algorithm Its input is table T. M matrix He Mingwen The output is in ciphertext. The encryption algorithm will start with The result after transposing the input plaintext vector Performing multiplication, we obtain a length of The result ; and then for each round and Firstly, according to The value in Intermediate results are obtained by performing a lookup operation on the table. Then all intermediate results The result is obtained by performing an XOR operation. The final matrix The result after transposition Performing multiplication yields the updated result. For a detailed description, please refer to Algorithm 7: Algorithm 8: Decryption Algorithm Its input is the external encoding matrix. key ciphertext The decryption algorithm first converts the external encoding matrix... The inverse matrix and the transpose of the ciphertext The result is obtained by performing multiplication. Then, the standard decryption algorithm is used. Will Decryption is performed, and finally, it is compared with the previous external encoding matrix. The final plaintext is obtained by multiplying the inverse matrix; see Algorithm 8 for details. Test effect verification The symmetric white-box encryption method based on substitution-permutation network structure proposed in this invention has been tested on cloud servers, personal computers, smartphones, Raspberry Pi 4 development boards, and UP2grove development boards. The experimental equipment is shown in Table 2.

[0024] Table 2 Experimental Equipment like Figure 3 , Figure 4 As shown, under different rounds and group number configurations of the substitution-permutation network, the present invention encrypts 1KB of data in no more than 1.1 milliseconds on a personal computer and generates a white-box component in no more than 4.0 milliseconds; encrypts 1KB of data on a cloud server in no more than 2.5 milliseconds and generates a white-box component in no more than 4.2 milliseconds; encrypts 1KB of data on a smartphone in no more than 13.4 milliseconds and generates a white-box component in no more than 4.5 milliseconds; encrypts 1KB of data on a Raspberry Pi 4 development board in no more than 63.9 milliseconds and generates a white-box component in no more than 21.6 milliseconds; and encrypts 1KB of data on a UP2grove development board in no more than 35.0 milliseconds and generates a white-box component in no more than 14.9 milliseconds.

[0025] like Figure 5 As shown, the invention is applied to the AES-128 encryption algorithm and its encryption efficiency is compared with that of existing white-box AES implementations. As the only implementation with white-box security, the encryption efficiency of the invention is only slightly increased compared to other solutions on various platforms.

[0026] like Figure 6As shown, this invention is applied to the AES-128 encryption algorithm and the standard AES decryption algorithm is tested. Algorithm 8 decryption algorithm Its decryption efficiency is comparable to the standard AES decryption algorithm on various platforms. Compared to the previous period, there was only a slight increase.

[0027] Experimental results show that the symmetric white-box encryption method based on substitution-permutation network structure in this invention has high computational efficiency on various experimental platforms.

[0028] The above description is merely a description of preferred embodiments of this application and is not intended to limit the scope of this application in any way. Any modifications or alterations made by those skilled in the art based on the above-disclosed technical content should be considered equivalent and valid embodiments, and all fall within the scope of protection of the technical solution of this application.

Claims

1. A symmetric white-box encryption method based on a substitution-permutation network structure, characterized in that, By converting substitution and key XOR operations into a pre-computed lookup table and introducing random secret components into it, the permutation matrix is ​​expanded, and the structure of the encrypted internal state is changed, making it difficult for attackers to recover the key or decrypt the data through white-box attacks. Includes the following steps: Step 1: White-box component generation; Step 2: Encrypt; Step 3: Decrypt.

2. The method for constructing a symmetric white-box encryption method based on a substitution-permutation network as described in claim 1, characterized in that, Step 1 includes: Step 1.1 Execute Algorithm 1, named This is a preprocessing matrix generation algorithm used to generate preprocessing matrices. The output is a preprocessing matrix. After execution is complete, proceed to step 1.2; Step 1.2 Execute Algorithm 2, named This is a pre-external encoding matrix generation algorithm, used to generate the pre-external encoding matrix. That is, the output is the front external encoding matrix. After execution is complete, proceed to step 1.3; Step 1.3 Execute Algorithm 3, named This is a post-processing matrix generation algorithm used to generate post-processing matrices. The output is a post-processing matrix. After execution is complete, proceed to step 1.4; Step 1.4 Execute Algorithm 4, named This is a post-external encoding matrix generation algorithm, used to generate the post-external encoding matrix. That is, the output is the post-external encoding matrix. After execution is complete, proceed to step 1.5; Step 1.5 Under the specified substitution-replacement network password parameters (enter the specified replacement box) Key parameters Execute Algorithm 5, named , is the T-table generation algorithm, used to generate the T-table, whose input is It is a pre-defined replacement box. It is a predefined key value, and the output is a table T. After execution is complete, proceed to step 1.6; Step 1.6 Execute Algorithm 6 under the specified substitution-permutation network cryptographic parameters (input the specified substitution matrix H), and name it... This is an M-matrix generation algorithm used to generate M matrices, whose input is... It is the substitution matrix specified by the substitution-permutation network cryptography algorithm. This is the preprocessing matrix generated in step 1.

1. It is the pre-external encoding matrix generated in step 1.

2. This is the post-processing matrix generated in step 1.

3. The external encoding matrix generated in step 1.4 is output as the M matrix. After execution is complete, proceed to step 1.7; Step 1.7 Generate the pre-external encoding matrix external encoding matrix T table and M matrix Output as a white-box component.

3. The method for constructing a symmetric white-box encryption method based on a substitution-permutation network as described in claim 2, characterized in that, The process of Algorithm 1 includes: S1.1 Randomly generate a size of Invertible bit matrix ; S1.2 The generated bit matrix With size identity matrix The size obtained by splicing is bit matrix ; S1.3 By means of Elementary row operations are performed to obtain the preprocessing matrix. ,in It is the first indivual Submatrix; Let , , For an 8-bit vector, the preprocessing matrix... satisfy ， ； S1.4 Output Preprocessing Matrix .

4. The method for constructing a symmetric white-box encryption method based on a substitution-permutation network as described in claim 2, characterized in that, The process of Algorithm 2 includes: S2.1 Randomly generate a size of Invertible bit matrix ; S2.2 Output Matrix ; The process of Algorithm 3 includes: S3.1 will have a size of identity matrix With size zero matrix The size obtained by splicing is bit matrix ; S3.2 By... Elementary column transformations are performed to obtain the post-processing matrix. ,in It is the first indivual Submatrix; for Post-processing matrix satisfy ， ； S3.3 Output Post-processing Matrix .

5. A method for constructing a symmetric white-box encryption method based on a substitution-permutation network as described in claim 2, characterized in that, The process of Algorithm 4 includes: S4.1 Randomly generate a size of Invertible bit matrix ; S4.2 Output Matrix .

6. The method for constructing a symmetric white-box encryption method based on a substitution-permutation network as described in claim 2, characterized in that, The process of Algorithm 5 includes: S5.1 For each round and Randomly generate a size of Invertible bit matrix Randomly generated The size is Invertible bit matrix Randomly generated A fake replacement box Randomly generated A fake key ; S5.2 For each round , and two-byte input Generate table T ； S5.3 Output T table .

7. A method for constructing a symmetric white-box encryption method based on a substitution-permutation network as described in claim 2, characterized in that, The process of Algorithm 6 includes: S6.1 For round 0, generate ； S6.2 For the first First, expand the permutation matrix. for ,in It is the first indivual Submatrix; the expansion method is to randomly generate two submatrices of size . Invertible bit matrix and and the permutation matrix specified by the original algorithm The newly generated matrix and a matrix of size zero matrix spliced ​​together to form a size of matrix ； Through the Elementary row and column transformations are performed to obtain the expanded permutation matrix. To satisfy ， ； Finally, the M matrix is ​​generated. ； S6.3 For the Rth round, expand the permutation matrix using the same method as in step S6.2, and generate matrix M. ； S6.4 Output M matrix .

8. The symmetric white-box encryption method based on a substitution-permutation network structure as described in claim 1, characterized in that, Step 2 includes an encryption algorithm. Its input is table T. M matrix He Mingwen The output is in ciphertext. The encryption algorithm will start with The result after transposing the input plaintext vector Performing multiplication, we obtain a length of The result ; and then for each round and Firstly, according to The value in Intermediate results are obtained by performing a lookup operation on the table. Then all intermediate results The result is obtained by performing an XOR operation. The final matrix The result after transposition Performing multiplication yields the updated result. .

9. A method for constructing a symmetric white-box encryption method based on a substitution-permutation network as described in claim 1, characterized in that, The encryption algorithm described in step 2 is Algorithm 7, and the processing procedure is as follows:

10. The symmetric white-box encryption method based on a substitution-permutation network structure as described in claim 1, characterized in that, Step 3 includes a decryption algorithm. Its input is the external encoding matrix. Predefined substitution-replacement network cryptographic parameter key ciphertext ; The decryption algorithm first converts the external encoding matrix into a single external encoding matrix. The inverse matrix and the transpose of the ciphertext The result is obtained by performing multiplication. Then use the standard decryption algorithm Will Decryption is performed, and finally, it is compared with the previous external encoding matrix. The final plaintext is obtained by multiplying the inverse matrix. The decryption algorithm described in step 3 is Algorithm 8, and the processing procedure is as follows:

Images