White-box soft-locking for node-specific cryptographic key protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic systems are vulnerable to side-channel attacks, particularly when deployed on open devices with general-purpose processors, as they lack effective mechanisms to protect against attacks that utilize execution timing, electromagnetic radiation, and power consumption information, and are difficult to implement securely across multiple nodes.
Innovation Solution
The implementation of a white-box soft-locking technique, which generates node-specific locked and globally encoded lookup tables to restrict cryptographic key operations to specific nodes, ensuring that secrets remain encoded and cannot be used across unauthorized nodes, while allowing globally encoded secrets to be securely shared between white-box instances.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If cryptographic systems are deployed on open devices with general-purpose processors, then accessibility and ease of operation are improved, but security against side-channel attacks deteriorates
Solution Approach 1:
The cryptographic system is segmented into multiple white-box instances, each tied to a specific node through node-specific locking transformations. This segmentation allows the system to be deployed across multiple open devices while maintaining security, as each instance can only operate on its designated node. The segmentation of cryptographic keys into node-specific and globally-encoded components enables secure distribution across open devices without compromising security.
Solution Approach 2:
The patent introduces white-box instances as intermediaries between the cryptographic keys and the open devices. These instances act as mediators that hide the actual cryptographic operations from attackers, even when deployed on open devices with full visibility. The white-box instances transform and encode secrets so that they cannot be extracted or misused, providing a security layer that works specifically for the intended node.
2Reliability
If white-box techniques are used to protect cryptographic operations, then security against side-channel attacks is improved, but device complexity increases
Solution Approach 1:
The patent creates a universal white-box implementation that can function across multiple nodes through globally-encoded secrets. A single white-box instance can serve multiple purposes: it can operate with node-specific secrets for local security and with globally-encoded secrets for cross-node operations. This multi-functionality reduces the need for separate implementations for each node, thereby managing complexity while maintaining security.
Solution Approach 2:
The system dynamically changes parameters such as node identifiers and encoding transformations based on the operational context. When a white-box instance is deployed, it adapts its behavior based on the node it is assigned to, using node-specific locking transformations. This parameter adaptation allows the same base implementation to securely operate across different nodes without requiring separate hard-coded implementations for each, thus managing complexity.
3Reliability
If node-specific locking transformations are applied to encode secrets, then security and reliability are improved, but adaptability across multiple nodes deteriorates
Solution Approach 1:
The patent implements dynamic adaptability where white-box instances can switch between node-specific and globally-encoded secret modes. The system is not statically locked to a single node but can dynamically adapt its operation based on the secret type being used. This dynamic behavior allows the same instance to maintain high security when using node-specific secrets while also being adaptable for cross-node operations when using globally-encoded secrets.
Solution Approach 2:
The patent adds a new dimension to secret encoding by introducing globally-encoded secrets that operate across multiple nodes, in addition to node-specific secrets. This dimensional expansion allows the system to maintain node-specific security while also enabling cross-node functionality. The dual-layer encoding approach (node-specific + globally-encoded) provides both security and adaptability without compromising either.
Data Source
AI summary
A method and apparatus for securely generating an output is disclosed. In one embodiment, the method comprises generating a white-box implementation having unlocked white-box look up table (LUTs) for node-encoded secrets, the node-encoded secrets to be encoded for operation solely on a node of a network and globally encoded white-box LUTs for globally-encoded secrets to be encoded for operation on the node and at least another node; generating, from the white box implementation, a soft-locked white-box implementation having a plurality of node-specific locked white-box LUTs and modified globally encoded LUTs. The method further comprises receiving a global secret encoded according to the base file; generating the node-encoded secrets by applying node-specific locking transformations to the global secret; and generating, by the node, the output according to at least one of the globally-encoded secrets or the node-encoded secrets.