White-Box Cryptography Key Management for Unsupported Algorithms
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cryptography systems face limitations in extending white-box cryptography protections to unsupported algorithms and in secure storage within cryptoprocessors, where not all encryption algorithms are supported by white-box cryptography, and secure memory in cryptoprocessors is often insufficient for storing all secret keys.
Innovation Solution
Implementing a method that maintains encrypted cryptography keys using white-box cryptography, performs anti-tampering verifications, and decrypts keys for unsupported algorithms, while also extending secure storage by using additional memory for encrypted data and disabling debugging to prevent access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If white-box cryptography is used to protect supported algorithms, then security against key extraction is improved, but unsupported algorithms cannot benefit from this protection
Solution Approach 1:
The patent introduces an intermediary layer consisting of wrapper functions and key management code that translates between unsupported algorithms and the white-box cryptography engine. This mediator layer allows algorithms like AES-256-GCM to be protected without requiring native white-box implementations, thus resolving the contradiction between security protection and algorithm support.
Solution Approach 2:
The cryptographic system is segmented into distinct components: the core white-box engine for supported algorithms, wrapper functions for key management, and algorithm-specific adaptation layers. This segmentation allows each component to be optimized independently while maintaining overall security, enabling unsupported algorithms to be protected through the standardized interface.
2Reliability
If secret keys are stored in cryptoprocessor secure memory, then external access to keys is eliminated, but storage capacity is insufficient for all secret keys
Solution Approach 1:
The patent extends secure storage from the constrained cryptoprocessor memory space to system-wide secure memory regions accessible only through controlled interfaces. By moving key storage to a different memory dimension with larger capacity and implementing runtime verification mechanisms, the system maintains key confinement security while accommodating multiple secret keys.
Solution Approach 2:
Anti-tampering verifications and memory protection mechanisms are established before keys are accessed or stored. The system pre-configures secure memory regions, sets up verification routines, and establishes access control policies in advance, enabling expanded key storage capacity while maintaining security constraints through预先 established protection measures.
3Ease of operation
If debugging is enabled for application development, then ease of development is improved, but security against tampering detection is reduced
Solution Approach 1:
The debugging capability is made dynamic rather than static. The system automatically enables debugging during development phases when verification checks are relaxed, and disables or hardens debugging protections during deployment when verification is enforced. This dynamic adjustment resolves the contradiction by providing development convenience when needed and security when required.
Solution Approach 2:
The system changes operational parameters of the debugging interface based on the runtime environment. Build-time configuration flags, hardware security module states, and runtime verification modes are adjusted to transform the debugging interface from an open development tool into a secured verification mechanism, maintaining both development ease and tampering detection capability.
Data Source
AI summary
Methods and systems for extending white-box cryptography are provided. A computing device can maintain, in a memory, one or more cryptography keys encrypted using a white-box cryptography solution. The one or more cryptography keys encrypt or decrypt data with a cryptography algorithm not supported by the white-box cryptography solution. The computing device can perform one or more anti-tampering verifications to detect tampering events for tampering with the computing device or an application installed on the computing device. The computing device can, upon determining that no tampering event is detected, decrypt the one or more cryptography keys using the white-box cryptography solution, and provide the one or more cryptography keys to encrypt or decrypt the data using the cryptography algorithm not supported by the white-box cryptography solution.