Grammar-Based Code Encryption for Secure Offline Updates
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for encrypting and decrypting computer codes in sensitive environments, such as payment terminals, face challenges in managing encryption keys and ensuring security during updates, especially when attackers may obtain multiple keys, and do not effectively protect against unauthorized access during local updates without network connectivity.
Innovation Solution
An intelligent coding phase is introduced before encryption, using a descriptive grammar of the code to transform it into a character string that can be encrypted with any of multiple encryption keys, ensuring that any decryption key, even if obtained by an attacker, results in a grammatically correct but potentially meaningless code, slowing down the attacker's ability to distinguish valid from invalid decryption results.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If code is encrypted using a single encryption key, then decryption is straightforward and fast, but security is compromised when the key is obtained by attackers
Solution Approach 1:
The encryption system is segmented into multiple independent encryption keys (at least two keys), where each key encrypts the code separately. This segmentation ensures that even if one key is compromised, the code remains protected by other keys, thereby improving security without requiring a fundamentally complex new system.
Solution Approach 2:
The system changes the parameter of encryption from using a single key to using multiple keys. This parameter change allows the system to maintain straightforward decryption processes while significantly enhancing security, as attackers would need to obtain all keys to successfully decrypt the code.
2Reliability
If multiple encryption keys are used to protect code, then security is improved against key compromise, but attackers can still obtain multiple keys and decrypt the code
Solution Approach 1:
A grammar-based validation mechanism is introduced as an intermediary layer between decryption and code execution. After decryption using any of the multiple keys, the resulting code must pass grammar validation to be considered valid. This intermediary prevents attackers from successfully using stolen keys, as the grammar check will fail for incorrectly decrypted code, thereby neutralizing the harm of key compromise.
Solution Approach 2:
The system converts the potential harm of multiple key availability to attackers into a benefit by using grammar validation. Even if attackers obtain multiple keys, the grammar-based approach ensures that only correctly decrypted code (which will pass grammar checks) can be executed, turning the presence of multiple keys from a security vulnerability into a feature that maintains system integrity.
3Adaptability or versatility
If code is updated locally without network connectivity, then updates can be performed offline, but key management and security verification become difficult
Solution Approach 1:
The system implements self-service through grammar-based validation that can be performed locally on the device without network connectivity. The grammar validation mechanism is embedded in the device, allowing it to independently verify the correctness of decrypted code during local updates. This eliminates the need for external key management services while maintaining security, enabling offline updates with built-in security verification.
4Device complexity
If traditional encryption is used without intelligent coding, then encryption process is simple, but attackers can easily identify valid decryption results
Solution Approach 1:
Grammar-based encoding is applied as a preliminary action before encryption. The code is first encoded according to grammatical rules, then encrypted using the multiple keys. This preliminary encoding step ensures that only correctly decrypted code will produce grammatically valid results, making it difficult for attackers to identify valid decryption results even if they obtain the keys. The complexity added is minimal and focused on the encoding stage.
Data Source
Figure 1~2
Figure 3
AI summary
Encryption method, corresponding encryption method, devices and programs. The invention relates to a method of encrypting a code to be encrypted (Sx) of a computer program using an encryption key (Kx) selected from at least two encryption keys (Kx, Ky, Kz). Such a method comprises: - a step of obtaining (11) a descriptive grammar (GD ) of the language of the code to be encrypted; - a step of coding (13) the code to be encrypted (Sx) using the descriptive grammar (GD ) delivering a character string (Cd C) in which at least one start instruction (InstrD) of the code to be encrypted (Sx) is coded by a representation (RInstrD) in the character string (Cd C); - a step of encoding (14) the character string (CdC) using an encryption key (Kx) belonging to the set of encryption keys (Kx, Ky, Kz), delivering an encrypted string (Cx). The decryption method comprises the reverse steps and also makes use of the descriptive grammar of the code to be encrypted.