White-Box Cryptographic Implementation String Binding

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Software implementations of cryptographic algorithms face challenges in preventing unauthorized use and tampering, as they can be copied and executed on unauthorized nodes, leading to the distribution of valuable cryptographic keys in uncontrolled ways.

Innovation Solution

A method is introduced to bind a white-box implementation to an arbitrary string, making it dependent on a set of strings for proper functioning, ensuring it can only be executed on legitimate devices or by authorized users, using techniques such as lookup tables and obfuscation to prevent code lifting and enhance tamper resistance.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If software implementations of cryptographic algorithms are made accessible for distribution, then convenience and ubiquity of digital content access is improved, but security and control over cryptographic keys deteriorate

Engineering Contradiction:

Improveconvenience of digital content accessVSAvoidsecurity of cryptographic keys

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The cryptographic implementation is segmented into multiple code fragments that are distributed separately. The complete functionality is only restored when all fragments are combined in the correct sequence, preventing unauthorized use of individual fragments and enabling controlled distribution across multiple nodes.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The code fragments are designed to be dynamically assembled at runtime based on specific conditions and node identities. This dynamic assembly process ensures that the cryptographic functionality is only activated when proper authorization is verified, providing flexible security control.

Inventive Principle:

Principle #15Dynamics

2Adaptability or versatility

If white-box implementation is distributed across multiple nodes, then accessibility and utility are improved, but risk of unauthorized copying and tampering increases

Engineering Contradiction:

Improvedistribution capabilityVSAvoidunauthorized copying and tampering

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

Code fragments are pre-bound to specific node identifiers or authentication credentials during the distribution phase. This preliminary binding ensures that only authorized nodes can execute the fragments, and any attempt to copy or tamper with the code will fail authentication verification.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

An intermediary verification mechanism is introduced that checks the authenticity and integrity of code fragments before execution. This intermediary layer acts as a gatekeeper, preventing unauthorized copying and tampering by validating node credentials and code integrity.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Reliability

If cryptographic functions are obfuscated to prevent reverse engineering, then security against attacks is improved, but difficulty of maintenance and updates increases

Engineering Contradiction:

Improveresistance to reverse engineeringVSAvoidmaintainability of cryptographic code

Core Design Contradiction:

ReliabilityVSEase of repair

Solution Approach 1:

The obfuscated cryptographic code is segmented into independent, modular fragments. Each fragment can be individually updated or repaired without affecting the entire system, maintaining security through obfuscation while enabling easier maintenance through modularity.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The code fragments are designed with universal interfaces and standardized communication protocols, allowing them to be maintained and updated using common development tools and processes despite the obfuscation, thus improving maintainability while preserving security.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentEP2960891B1Method for introducing dependence of white-box implementationon a set of strings

Publication Date: 2019.01.16 NXP BV

Figure 1~2
Figure 3~4
Figure 5~6

AI summary

A method of performing a cryptographic operation using a cryptographic implementation in a cryptographic system, including: receiving, by the cryptographic system, an identifying string value; receiving, by the cryptographic system, an input message; performing, by the cryptographic system, a keyed cryptographic operation mapping the input message into an output message wherein the output message is the correct result when the indentifying string value is one of a set of binding string values, wherein the set includes a plurality ofbinding string values.