White-Box Cryptography Module for Secure Terminal Data Exchange
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cryptographic key exchange mechanisms in telecommunications networks are vulnerable to attacks if a malicious third party obtains the cryptographic keys, especially when devices like terminals are less secure than servers.
Innovation Solution
Implementing a white-box cryptography mechanism where a server generates a white-box cryptography module for a terminal, burying the symmetric key within the module's code, and using a physical unclonable function to authenticate and encrypt/decrypt messages, ensuring the key is not stored on the terminal and thus not accessible to attackers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic keys are stored in terminal devices for data encryption/decryption, then data confidentiality is maintained, but the system becomes vulnerable to attacks when terminals are compromised
Solution Approach 1:
The patent extracts the cryptographic key from the terminal device and stores it exclusively on the server. The terminal receives only encrypted data and decryption instructions, never the actual key material. This extraction eliminates the vulnerability where compromised terminals could expose stored keys, while maintaining data confidentiality through server-side key management.
Solution Approach 2:
The patent introduces a trusted server as an intermediary between the terminal and the cryptographic key. The server acts as a mediator that holds the key securely and performs decryption operations on behalf of terminals. This intermediary architecture allows terminals to access encrypted data without directly possessing the key, reducing their attack surface while maintaining confidentiality.
2Object-affected harmful factors
If cryptographic keys are embedded in terminal code for white-box cryptography, then key extraction attacks are prevented, but the module complexity increases
Solution Approach 1:
The patent implements white-box cryptography by nesting the cryptographic key within the terminal's code as a series of obfuscated transformations. The key is embedded in a nested structure where it is transformed through multiple layers of encryption and mixing operations, making it invisible and inaccessible to external analysis while remaining functional for decryption.
Solution Approach 2:
The patent transforms the cryptographic key through parameter changes in the form of obfuscated mathematical transformations. The key material is encoded as a sequence of parameter transformations that change its representation repeatedly, making statistical analysis and extraction attacks ineffective while preserving the key's cryptographic functionality.
Data Source
AI summary
A secure method for data exchange between a terminal and a server is described. The server can use a cryptographic module configured to encrypt or decrypt a message based on input parameters comprising the message, a response to a challenge and a symmetric key. The terminal can use a white-box cryptography module constituting a white-box implementation of the cryptographic module of the server for this symmetric key.