Secure-Enclave Data Processing With Sponge Duplex Obfuscation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems-on-chip (SOC) secure enclaves face challenges in providing robust encryption and authenticated encryption for data stored outside the enclave while maintaining performance and reducing hardware and software costs, particularly against side-channel and fault attacks.
Innovation Solution
A computer-implemented method using a cryptographic function with a sponge duplex construction that applies obfuscation functions to input data before processing, ensuring secure encryption and decryption by introducing an additional layer of security against side-channel attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If AES-based encryption is used in secure enclaves, then security robustness is improved, but hardware cost and complexity increase
Solution Approach 1:
The patent uses a simplified cryptographic function that copies the essential security properties of AES through a sponge duplex construction, achieving comparable security robustness against side-channel and fault attacks without requiring the full AES hardware implementation. This reduces hardware gate count while maintaining security equivalence.
Solution Approach 2:
The patent employs lightweight cryptographic primitives and a streamlined sponge function design that uses fewer hardware resources compared to AES. The simplified construction achieves adequate security for the specific secure enclave application without the overhead of implementing the complete AES standard, thereby reducing hardware cost.
2Reliability
If AES-based encryption is used in secure enclaves, then security robustness is improved, but performance deteriorates
Solution Approach 1:
The sponge duplex construction replicates the security functionality of AES with a more performance-efficient architecture. By using a simplified permutation function and optimized state management, the patent achieves comparable security outcomes with faster execution speed and lower computational overhead.
Solution Approach 2:
The patent adjusts cryptographic parameters such as the sponge function rate and capacity, and the number of rounds, to optimize performance for the specific secure enclave application. These parameter optimizations enable faster encryption operations while maintaining robust security against side-channel and fault attacks.
3Reliability
If obfuscation functions are applied to input data, then security against side-channel attacks is improved, but device complexity increases
Solution Approach 1:
The patent introduces obfuscation functions as intermediary layers between the input data and the sponge duplex construction. These obfuscation functions mask the true data values and operation patterns, preventing side-channel attackers from extracting sensitive information through power analysis or timing attacks, while the overall system complexity remains manageable.
Data Source
Figure 1
Figure 2A~2B
Figure 3
AI summary
A computer-implemented method, executed within a secure environment, comprises: receiving input data comprising a message, the message comprising N message portions, where N is greater than or equal to 1; initializing a cryptographic function by retrieving, selecting or generating initial state data, the cryptographic function comprising a message processing phase (MPP); applying a first stage of the MPP of the cryptographic function, wherein applying the first stage of the MPP of the cryptographic function comprises: applying a first MPP obfuscation function to a first MPP obfuscation function input to generate a first obfuscated MPP input, the first MPP obfuscation input derived from a received message portion; and applying a first MPP function to a first MPP function input derived from the first obfuscated MPP input and the initial state data of the encryption function to generate a first MPP output.