Table Network Security via Dual-Verification Encoding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current countermeasures against side-channel attacks and reverse engineering in computer systems are inadequate, as they can be countered by statistical analysis and advanced program operation analysis, and even obfuscated table networks may reveal the encoded function through statistical properties of input/output relations.
Innovation Solution
A computing device with a first table network that operates on multiple input values, using an encoding that encrypts two or more inputs into a single value, and a second table network that verifies the integrity of the first table network by checking if an unmodified version could produce specific outputs from given inputs, thereby producing a protected function output that differs from the original output if modification is detected.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a table network is used to implement cryptographic functions, then computation speed is improved, but security against reverse engineering and side-channel attacks deteriorates because the table structure and encoding can be analyzed
Solution Approach 1:
The patent divides the cryptographic system into two separate table networks: a first table network that performs the actual cryptographic computation and a second table network that performs verification. This segmentation allows each component to be optimized for its specific function while collectively providing both speed and security. The first table network maintains computation efficiency through pre-computed lookup tables, while the second table network provides security by verifying integrity without significantly impacting overall performance.
Solution Approach 2:
The patent introduces a second table network as an intermediary verification layer between the cryptographic computation and the output. This intermediary component does not perform the main cryptographic function but verifies that the first table network has not been modified or attacked. The second table network acts as a mediator that checks the integrity of computations by performing parallel verification using shared input values, thereby protecting against reverse engineering and side-channel attacks without compromising the speed of the primary cryptographic operation.
2Reliability
If encoding is applied to hide the function performed, then security is improved, but the ability to verify correct operation deteriorates
Solution Approach 1:
The patent creates a copy of the verification logic in the second table network that mirrors the structure and encoding of the first table network. Both table networks use the same encoding schemes and share identical input values, allowing the second network to produce expected output values that serve as verification references. This copying approach maintains security through encoding while enabling verification, as the copied structure allows comparison between actual and expected outputs without requiring decoding or exposing internal function details.
3Reliability
If randomness is introduced to counter side-channel attacks, then security is improved, but computation complexity and energy consumption increase
Solution Approach 1:
The patent pre-computes and stores lookup tables during a setup phase before actual cryptographic operations. The first and second table networks are populated with pre-calculated values that encode cryptographic functions, eliminating the need for complex real-time computations during operation. This preliminary action reduces computation complexity and energy consumption during actual use, as the system simply performs table lookups rather than executing complex algorithms, while still maintaining security against side-channel attacks through the verified encoded structure.
Data Source
AI summary
A computing device configured to compute a data function on a function-input value, the device comprising an electronic storage storing a first table network configured for the data function and a second table network configured to cooperate with the first table network for countering modifications made to the first table network, an electronic processor coupled to the storage and configured to obtain first table inputs for the first table network, the first table inputs including the function-input value, and to compute the data function by applying the first table network to the first table inputs to produce first table outputs, the first table outputs including a function-output value corresponding to the result of applying the data function to the function-input value.