White-Box Cryptographic Parameter Integrity

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Digital rights management systems face vulnerabilities in software plug-ins and key distribution and handling, particularly on PC platforms where users have control over hardware and software, making it difficult to secure content protection and enforce usage terms.

Innovation Solution

A method that incorporates a data string into a bit representation of parameters used in a data processing system, ensuring that changes to the data string result in a change to the data processing function, thereby protecting the integrity of the system by making it difficult to tamper with the data processing without altering the function.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If encryption techniques are used to protect digital content, then content security is improved, but software plug-ins and key handling become vulnerable to attacks

Engineering Contradiction:
Improvecontent securityVSAvoidvulnerability to attacks
Core Design Contradiction:
ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent combines the data string with the parameters used in data processing functions by incorporating the data string into the bit representation of the parameters. This merging ensures that the parameters serve dual purposes: maintaining the data processing function while simultaneously protecting the data string. Any attempt to attack or modify the parameters would directly affect the data processing function, making the system more resilient to attacks on software plug-ins and key handling mechanisms.

Inventive Principle:
Principle #5Merging (Combining)

2Reliability

If parameters are made tamper-resistant by incorporating data strings, then system integrity is improved, but the complexity of parameter management increases

Engineering Contradiction:
Improvesystem integrityVSAvoidparameter management complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The patent applies preliminary action by pre-incorporating the data string into the parameters before the data processing function is executed. This pre-integration ensures that the parameters are already protected against tampering before any processing occurs, eliminating the need for additional complex protection mechanisms during runtime. The data string is embedded in the parameter structure itself, so no separate management or verification steps are required during execution.

Inventive Principle:
Principle #10Preliminary action

3Reliability

If the data string is incorporated into parameters, then tamper-resistance is improved, but the flexibility of parameter modification is reduced

Engineering Contradiction:
Improvetamper-resistanceVSAvoidparameter modification flexibility
Core Design Contradiction:
ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent applies local quality by making the parameters locally adapted to include the specific data string required for protection. Each parameter is customized to incorporate its associated data string in a way that maintains the local data processing function while providing tamper resistance. This localized integration means that modifications can still occur in controlled, function-specific ways without compromising overall system security, as each parameter's structure is optimized for its particular processing role.

Inventive Principle:
Principle #3Local quality

Data Source

PatentEP1997265B1Integrity of a data processing system using white-box for digital content protection
Publication Date: 2020.08.05 IRDETO BV
  • EP1997265B1 patent drawingFigure 1
  • EP1997265B1 patent drawingFigure 2
  • EP1997265B1 patent drawingFigure 3

AI summary

A method of protecting an integrity of a data processing system. The method comprises determining (902) a data string to be protected, an integrity of the data string being an indication of the integrity of the data processing system. Computing (904) a set of parameters representing a predetermined data processing function, using a redundancy in the set of parameters to incorporate the data string into a bit representation of the set of parameters. Enabling (906) the system to process data according to the set of parameters. The set of parameters represents at least part of a cryptographic algorithm including a cryptographic key. The set of parameters represents a network of look-up tables. The network of look-up tables comprises a plurality of look-up tables of a white-box implementation of a data processing algorithm. The data processing algorithm comprises a cryptographic algorithm.