Cryptographic Function Implementation via Virtual Machine Obfuscation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing white box cryptography solutions are incompatible with certain operating systems, particularly mobile ones, due to the requirement for individual code versions for each user, which is not feasible with current validation and authorization processes.
Innovation Solution
A method involving the construction and execution of a unique sequence of cryptographic macro-instructions by a virtual machine, using a generic list of macro-instructions and an individual descriptive data file specific to the secret key, allowing obfuscation of the key without violating OS platform restrictions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If white box cryptography is implemented by merging keys with the function using individual code versions for each user, then secret extraction is prevented even with complete access to the algorithm's software implementation, but compatibility with mobile operating systems is lost because these systems only allow code to be loaded from official application platforms after validation and do not allow subsequent loading or modification of code by intermediate users or end users
Solution Approach 1:
The cryptographic implementation is divided into two separate components: a generic application containing the algorithm code that can be validated and distributed through official OS platforms, and individual data files containing key-specific parameters that are loaded separately. This segmentation allows the code portion to meet OS validation requirements while the data portion provides user-specific customization without requiring code modification or re-validation.
Solution Approach 2:
The patent introduces an intermediary mechanism where the generic application acts as a container that can load and execute different individual data files. This intermediary structure allows the system to maintain a single validated code base while supporting multiple user-specific configurations, effectively mediating between the OS platform's code validation requirements and the need for individualized cryptographic implementations.
2Reliability
If individual code versions are created for each user to obfuscate the secret key, then the cryptographic function becomes resistant to attacks, but the complexity of application distribution and platform authorization increases significantly
Solution Approach 1:
By separating the cryptographic implementation into a shared generic application and user-specific data files, the system eliminates the need to create, validate, and distribute individual code versions for each user. The segmentation allows one validated application to serve multiple users with different cryptographic parameters, dramatically reducing distribution complexity while maintaining security.
Solution Approach 2:
The generic application serves as a template that can be copied and distributed through official platforms once, then reused for multiple users by loading different individual data files. This copying approach avoids the need to create and validate separate code versions for each user, reducing the complexity of application distribution while maintaining individualized security parameters.
3Adaptability or versatility
If the OS application platform allows uploading of a common version of the application with individual blocks of code inserted by certified bodies, then individualized cryptographic functions can be provided, but this creates a loophole in the current validation process which OS providers are unlikely to accept
Solution Approach 1:
The patent segments the cryptographic system into code and data components, allowing the code to be validated once by the OS platform while the data files are generated and loaded separately by certified bodies or users. This avoids the need to modify or re-validate the application code, preserving the integrity of the platform validation process while enabling individualized cryptographic support.
Solution Approach 2:
The generic application acts as an intermediary that provides a standardized interface for loading user-specific data files. This intermediary structure allows certified bodies to provide individualized cryptographic parameters without needing to insert code into the application, thus maintaining the validation process integrity while achieving adaptability.
Data Source
Figure 1
Figure 2(a1)~2(a2)
AI summary
The present invention relates to a method for implementing a cryptographic function for a secret key, the method being characterized in that it comprises the implementation, by data processing means (11) of equipment (1), of steps of: (b) Construction of a unique sequence of cryptographic macro-instructions, representing said cryptographic function for said secret key, as a function of: - a generic list of cryptographic macro-instructions executable by a given virtual machine; and - an individual file of descriptive data of said sequence; (c) Execution, by said virtual machine, of said unique sequence of cryptographic macro-instructions.