Compiler SSA Graph Subgraph Replacement for White-Box Data Hiding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for hiding sensitive data during program execution, such as masking and white-box cryptography, are inefficient and require substantial designer involvement, and often result in large tables or memory-intensive implementations.
Innovation Solution
A compiling device that uses Static Single Assignment (SSA) graphs to identify and replace subgraphs with smaller input sizes, employing a min-cut algorithm to minimize memory usage and automate the hiding process, allowing for efficient white-box implementations with reduced programmer effort.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If masking is used to hide sensitive data, then data visibility is reduced, but memory usage increases and encrypted data must be maintained
Solution Approach 1:
The patent extracts and removes sensitive runtime data from the program by replacing it with pre-computed constant tables. The SSA graph analysis identifies which variables and operations should be hidden, then systematically removes them by substituting with lookup tables that contain pre-computed results, thereby eliminating the need to store sensitive data in memory during execution.
Solution Approach 2:
The patent applies preliminary action by pre-computing and storing results in constant tables before runtime. During compilation, the system pre-evaluates expressions involving hidden variables and stores the results in lookup tables. At runtime, these pre-computed tables are used directly, avoiding the need to compute or store sensitive data during execution.
2Object-affected harmful factors
If white-box cryptography is used to protect data, then protection level increases, but designer involvement and complexity increase substantially
Solution Approach 1:
The patent applies self-service by enabling the compiler to automatically perform the complex task of white-box transformation without requiring manual designer intervention. The system uses SSA graph analysis to automatically identify hidden variables, determines which operations need protection, and generates the appropriate constant tables and transformed code automatically during compilation, making the process self-service rather than manually intensive.
Solution Approach 2:
The patent replaces the mechanical manual process of white-box cryptography design with an automated compiler-based system. Instead of designers manually analyzing and transforming code, the compiler automatically performs SSA analysis, identifies protection targets, and generates the transformed implementation, substituting automated mechanical processing for manual design work.
3Ease of manufacture
If direct replacement of subgraph in SSA graph is performed, then implementation simplicity increases, but efficiency decreases
Solution Approach 1:
The patent applies local quality by optimizing different parts of the SSA graph with different strategies based on their specific characteristics. Rather than applying a uniform replacement approach, the system analyzes each subgraph locally to determine the most efficient transformation, selecting which variables to hide, which operations to pre-compute, and how to structure the resulting lookup tables based on local graph properties and data flow patterns.
Data Source
AI summary
A compiling device (100) configured to convert a source code computer program (102) into an object code computer program (106), the compiling device comprising—a processor circuit arranged to—parse (120) the source code computer program and generate a static single assignment (SSA) graph (122) for at least a portion of the source code computer program, and—search for a second subgraph (P) of the SSA graph, wherein a first subgraph (N) is a subgraph of the second subgraph (N⊆P), a sum of the bit sizes associated to incoming edges of the second subgraph being smaller than a sum of the bit sizes associated to incoming edges of the first graph, —implementing the second subgraph of the SSA graph in the object code computer program as a single operation thus omitting the assignments corresponding to edges of the first subgraph.