Data Protection via Regenerative Authentication Functions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Insecure communication channels between entities can lead to data modification or injection attacks, compromising data integrity and origin verification, especially in white-box environments where attackers can manipulate software execution to bypass MAC verification.
Innovation Solution
A method involving a predetermined function and combination functions to generate and process data in a way that regenerates the original data from modified elements, ensuring data integrity and origin without explicit authentication steps, using functions like s(w) = a × b^N + ∑(w_i × b^(N-1-i) for data protection and regeneration.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If MAC verification is implemented in software in a white-box environment, then data authentication can be performed, but attackers can manipulate software execution to bypass MAC verification
Solution Approach 1:
The patent introduces a trusted execution environment (TEE) as an intermediary between the MAC verification process and the attacker. The TEE creates a secure boundary that prevents white-box attacks from manipulating the verification logic, while still allowing the MAC authentication to function. The secure element acts as a mediator that the attacker cannot compromise even with full visibility into the software execution.
2Reliability
If explicit MAC comparison steps are used for data verification, then data integrity can be checked, but the system becomes vulnerable to manipulation in white-box environments
Solution Approach 1:
The patent extracts the MAC verification process from the vulnerable software environment and relocates it to a secure hardware element. This separation removes the verification logic from the attacker's reach while maintaining the integrity checking functionality. The secure element handles the sensitive comparison operations in isolation from the main processing system.
3Ease of operation
If data is transmitted over insecure channels without additional protection, then communication is simple, but data origin and integrity cannot be verified
Solution Approach 1:
The patent applies preliminary action by pre-computing and embedding authentication data (such as MACs or cryptographic signatures) into the data stream during the original data preparation phase. This allows the receiving system to verify data origin and integrity without requiring complex real-time protection mechanisms during transmission. The authentication information is prepared in advance and can be verified efficiently at the destination.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method for a first entity to protect a first amount of data and to enable a second entity to perform data processing based on the first amount of data, the method comprising the first entity: applying a predetermined function to the first amount of data to generate a first value; and generating a second amount of data for the second entity to process, said generating comprising combining, using a first combination function, each of a number N of elements of the first amount of data with the first value; wherein the predetermined function is a function for which application of the predetermined function to an input quantity of data generates a corresponding output value, and the predetermined function has a property that, given a second quantity of data generated by modifying each of N elements of a first quantity of data by combining, using the first combination function, each of those N of elements of the first quantity of data with the output value generated by applying the predetermined function to the first quantity of data, the first quantity of data is regenerated from the second quantity of data by combining, using a second combination function, each of the N modified elements with the output value produced by applying the predetermined function to the second quantity of data.